topic Re: Splunk SDK Search is slow in Splunk Dev

Splunk SDK Search is slow

TheMilkMan — Sun, 07 Jun 2020 18:44:40 GMT

The Splunk query using Splunk SDK using C# returns results much slower than the front end.

Query

index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }

Re: Splunk SDK Search is slow

wmyersas — Fri, 29 Nov 2019 14:42:17 GMT

What is your search?

How are you connecting with the SDK?

Re: Splunk SDK Search is slow

TheMilkMan — Fri, 29 Nov 2019 14:52:26 GMT

index=TEST "

Re: Splunk SDK Search is slow

TheMilkMan — Fri, 29 Nov 2019 14:52:39 GMT

index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }