Splunk taking minutes to load dashboard is not a problem imposed by post-calculation, it's more of a problem of lack of schema.
Most post calculation works on free text logs and thus has to regex it's way to a solution.
But it doesn't have to be that way; that's why the original poster talked about a lack of tooling in the post-calculation world
Most post calculation works on free text logs and thus has to regex it's way to a solution. But it doesn't have to be that way; that's why the original poster talked about a lack of tooling in the post-calculation world