dynamic form... is it normal to be this slow?

Question

A simple query runs very quickly (3s)... but when I use that same query to build a dynamic form (either radio or dropdown) the query takes apporx 60s. As a test I have eliminated charts so the form only creates a dropdown list (or radio buttons) plus a row of static HTML (becuase apparently I must have a childobject within the form). But it still takes approx 60s.

My question is... is this normal.. or is there soemthing wrong with my simple XML?

    <form>
<label>Test InvertedFlow 5</label>
<fieldset autoRun="true">
<input type="radio" token="ip">
<label>Select Store IP</label>
<populatingSearch fieldForValue="nps_radiusClientIP" fieldForLabel="nps_radiusClientIP">
<![CDATA[index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP]]>
</populatingSearch>
<earliestTime>-4h</earliestTime>
<latestTime>now</latestTime>
</input>

<input type="time">
<default>Last 4 Hours</default>
</input>
</fieldset>

<row>
<html>
<p>This is an <i><b>HTML panel</b></i> providing links to saved searches.</p>
</html>
</row>
</form>

Accepted Answer

Through trial and error I discovered, when possible/practicable, replacing the dynamically populated lookup (where list items are generated from query results) with a static lookup (where list items are coded within the xml) is much quicker. In hind site this seems kind of obvious. Whether trying to populate a list of radio buttons or a drop-down list, it will take longer if splunk has to query an index vs simply pulling list items right out of the xml it is already reading.

More info on how to replace a dynamically populated drop-down with a static drop-down here convert dynamic drop-down to static in advanced xml on Splunk Answers

Answer 2

0

index=winradius eventtype=nps_accessReqRejected | top nps_radiusClientIP

runs over all time. change it to

index=winradius eventtype=nps_accessReqRejected earliest=-24h | top nps_radiusClientIP

and I'll bet it runs much much faster...

link

answered 09 Nov '12, 15:06

lguinn ♦
10.9k●5●7●23
accept rate: 28%

dynamic form... is it normal to be this slow?

Follow this question

Splunk Resources

Related questions