Third in my three-part Splunk series. This article explains how to optimize a Splunk dashboard for faster loading when it contains multiple queries. Instead of allowing panels to run hard-coded searches continuously, use tokens so that each panel executes only when its corresponding menu selection is active. This guide is intended for intermediate Splunk users who have already built dashboards with multiple queries — see [Splunk 1: How to Add a Panel in the Dashboard](/blog/Splunk_1_Add_a_Panel) — and completed foundational Splunk training. > Note: the index name used in the example queries below (`main`) is a placeholder — swap it for your own index name. ## Overview When you build a dashboard that aggregates queries from multiple data sources, you might notice that a query takes more than three minutes to run and returns no results when you click one of the panels. This often happens because the *hidden* panels in your dashboard are executing their queries simultaneously, causing performance issues. To resolve this, assign different tokens and values to each panel so that only the selected query runs when you click it. ## Step 1 — Where to find and edit the script 1. Open your dashboard → **Edit** → **Source**. 2. Scroll to the bottom to find the newest panel you just added. 3. You can now view and modify the complete dashboard script here. When you add a new panel, Splunk appends its XML to the **end** of the dashboard source. If the panel's `` contains a hard-coded `source=...`, that search will execute even when the panel isn't relevant to the user's current selection. With many panels, this wastes resources and slows the dashboard. **Example (hard-coded; avoid):** ```spl index=main source="/var/log/shibboleth/*.log" | stats count by host | sort -count ``` ## Step 3 — How to fix it 1. **Locate the introduction section.** Use a keyword search in the dashboard source to quickly find the code related to different panels. You'll usually want to search for `/var/log/[name]` to find a specific section; for example, search `var/log/shibboleth` to find the panel made with Shibboleth logs. 2. **Confirm you're in the correct section.** You should see a paragraph like *"Use the log type selector on the right to explore Shibboleth-related activities…"* — this verifies you're editing the Shibboleth Logs panel. 3. **Find the choice section.** Scroll down to locate the `` block that defines the dropdown options. This section controls which log file the dashboard queries. For example: ```xml Show Shibboleth Panel Shibboleth Log Clear /var/log/shibboleth/*.log ``` Edit this section as needed to align the token names and log paths with your current dashboard configuration. ## Step 4 — Update the Token and Log Path In this step, you'll define the log source for the Shibboleth panel and ensure it connects correctly with the token used in your query. ### 1. Locate the choice and set elements Scroll to the `` block for **Show Shibboleth Panel** in your dashboard's XML. You should see two key lines: ```xml Shibboleth Log ... /var/log/shibboleth/*.log ``` - `` defines what appears in the dropdown list. The value inside (`/var/log/shibboleth/*.log`) is what will be passed when the user selects *Shibboleth Log*. - `` assigns that value to a token (`selected_log_shibboleth`). This token can later be referenced in your query as `source="$selected_log_shibboleth$"`. ### 2. Why this matters Before tokenization, every panel contained a hard-coded query, which caused Splunk to run all searches at once, even when hidden. By using tokens: - Only the selected log source will run. - Unselected panels stay idle, significantly improving dashboard load time. ### 3. Verify token linkage Make sure the panel query that depends on this selection uses the same token name: ```spl index=main source="$selected_log_shibboleth$" | stats count by host ``` If the token name (`selected_log_shibboleth`) doesn't match exactly, the query won't receive the correct value. ### 4. (Optional) Customize for other logs To add more log options, duplicate the `` and `` pairs and adjust both values accordingly: ```xml Vault Log /var/log/vault/*.log ``` > **Tip:** Use consistent token names, e.g. `$selected_auth_log$` for System → Authentication Logs, `$selected_log_shibboleth$` for Shibboleth under that branch. Only one of these should be set at a time based on the user's selection. ## Outcome After tokenizing every panel this way, only the query the user actually selects runs — hidden panels stay idle instead of firing their searches in the background. On a dashboard with a dozen-plus log sources, this took load times from multiple minutes down to seconds for the selected view.