Hi,
I have a below code which runs very slow because it is hitting the voluminous index to get the data which takes the huge time to retrieve the data for the particular dashboard ( I am using inline searches i.e.Plex ) , Please see the code below :
System Overview
`
*
False
1
`
Select Report Time Period
`
index=os sourcetype=vmstat source=plex earliest=-5m@m latest=now | lookup serverlist host | table server | dedup server | sort str(server) HOST_NAME Server List : 4 server="$value$" +OR+ ( $value$ ) server server <module name="SubmitButton">
<param name="label">Submit</param>
index=os | lookup serverlist host | search $HOST_NAME$ | avg(Percent_CPU_Load) by host_server useother=f limit=0
Percent Load by Host
Time
% Total CPU
connect
line
100%
flashtimeline
</module>
</module>
`
I want to use “scheduled saved searches”(Splunk) instead of “inline” and server name should be picked dynamically as it was being picked before ( in the above code )
Please help !!