Create a table metrices

dwibedi03 — Fri, 30 Oct 2020 17:43:35 GMT

I have a huge proxy logs for which need to create a monthly report since Jan 2019. Is there a way I can create the search that runs quick and I am able to create the table.

My current search

index=xyz | timechart span=1mon count by action

runs very slow for this huge data. I have also tried the datamodel route and yet the table is not getting created. Is there a way to create for each month and consolidate together in a optimized way?

Re: Create a table metrices

richgalloway — Fri, 30 Oct 2020 20:47:18 GMT

Searching a huge log will almost always take a huge amount of time. Using a datamodel will help, but only if the datamodel is accelerated.

There are some basic steps you can take to speed up the search.

Start by qualifying the search. Reading everything in index xyz probably is not necessary so specify the data you want, either by source, sourcetype, or some other field.

Use the fields command to reduce the number of fields Splunk has to keep track of.

Filter your data. Once you've read events from the index, eliminate those that don't apply to your report.

Consider running the report several times over smaller time ranges (1 per quarter, perhaps). This may not be feasible for all reports.

topic Create a table metrices in Dashboards & Visualizations

Create a table metrices

Re: Create a table metrices