DEV Community

Maxime Guilbert
Maxime Guilbert

Posted on • Edited on

3 3

Splunk - Dashboard request optimization

Creating a dashboard in Splunk can be really heavy and long to load if it's not optimized.

The biggest part of the optimization is the reusage of requests.

To do it easily, Splunk implemented a search object which can be use as basis for other requests.

<search id="baseSearch">
    <query>$env$ $project$ action=$action$  $typeCode_tok$
    | table timestamp, etransferId, application.name, context, action, correlationId,dd.trace_id, error.code, error.text, log, _raw 
    | sort timestamp $sort$, time $sort$
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
</search>
Enter fullscreen mode Exit fullscreen mode

Like this, a big part is already loaded and you just have to refine some elements for a particular graph.

<search id="baseSearch">
    <query>$env$ $project$ action=$action$  $typeCode_tok$
    | table timestamp, etransferId, application.name, context, action, correlationId,dd.trace_id, error.code, error.text, log, _raw 
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>

  <search id="baseSearchLatest" base="baseSearch">
    <query>search 
    | stats latest() by dd.trace_id 
    | rename latest(error.code) AS error.code | fillnull value="emptyVal" error.code
    | rename latest(action) AS action | fillnull value="null" action
    | rename latest(error.text) AS error.text
    </query>
  </search>
Enter fullscreen mode Exit fullscreen mode

I hope it will help you! 🍺


You want to support me?

Buy Me A Coffee

Image of Timescale

Timescale – the developer's data platform for modern apps, built on PostgreSQL

Timescale Cloud is PostgreSQL optimized for speed, scale, and performance. Over 3 million IoT, AI, crypto, and dev tool apps are powered by Timescale. Try it free today! No credit card required.

Try free

Top comments (0)

A Workflow Copilot. Tailored to You.

Pieces.app image

Our desktop app, with its intelligent copilot, streamlines coding by generating snippets, extracting code from screenshots, and accelerating problem-solving.

Read the docs