https://community.splunk.com/t5/Knowledge-Management/datamodel-query-taking-too-long/m-p/522491#M4754 <P>Hi</P><P>My query taking too long.. and its&nbsp;</P><P>&nbsp;</P><P>| from datamodel:Intrusion_Detection.IDS_Attacks<BR />| where _time&gt;relative_time(now(),"-10s@s")<BR />| stats values(tag) as tag,dc(signature) as count by src | where count&gt;25</P><P>&nbsp;</P><P>And it seems it will never return output</P><P>any idea?</P> Thu, 01 Oct 2020 13:50:05 GMT havatz 2020-10-01T13:50:05Z https://community.splunk.com/t5/Knowledge-Management/datamodel-query-taking-too-long/m-p/522491#M4754 <P>Hi</P><P>My query taking too long.. and its&nbsp;</P><P>&nbsp;</P><P>| from datamodel:Intrusion_Detection.IDS_Attacks<BR />| where _time&gt;relative_time(now(),"-10s@s")<BR />| stats values(tag) as tag,dc(signature) as count by src | where count&gt;25</P><P>&nbsp;</P><P>And it seems it will never return output</P><P>any idea?</P> Thu, 01 Oct 2020 13:50:05 GMT https://community.splunk.com/t5/Knowledge-Management/datamodel-query-taking-too-long/m-p/522491#M4754 havatz 2020-10-01T13:50:05Z https://community.splunk.com/t5/Knowledge-Management/datamodel-query-taking-too-long/m-p/522521#M4755 <P>What is the time window being searched?&nbsp; How large is the data set being searched?&nbsp; Why use where instead of selecting -10s from the time picker?</P> Thu, 01 Oct 2020 14:57:12 GMT https://community.splunk.com/t5/Knowledge-Management/datamodel-query-taking-too-long/m-p/522521#M4755 richgalloway 2020-10-01T14:57:12Z