https://community.splunk.com/t5/Reporting/Search-Optimization-on-my-query/m-p/537110#M8711 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/204073">@bapun18</a>,</P><P>Please try this below;</P><LI-CODE lang="markup"> index=syslogs earliest=-5m | lookup my_devices_lookup device_ip as host OUTPUTNEW device_ip as found | where isnull(found) | stats values(device_ip) by _time SYSLOG_mne SYSLOG_message</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 25 Jan 2021 19:57:38 GMT scelikok 2021-01-25T19:57:38Z https://community.splunk.com/t5/Reporting/Search-Optimization-on-my-query/m-p/537083#M8710 <P>Hi,<BR />I have a query that is giving me results in around 60-70 seconds I wanted to reduce the time, seems NOT is taking more time and my search is parsing for around 35-40 seconds. Please help me to optimize the below query so that it will run within 30 seconds.<BR /><BR />index=syslogs earliest=-5m<BR />| fields _time host SYSLOG_mne SYSLOG_message<BR />| rename host as device_ip<BR />| dedup device_ip<BR />| search NOT<BR />[| inputlookup my_devices_lookup<BR />| dedup device_ip<BR />| table device_ip]<BR />| fields _time device_ip SYSLOG_mne SYSLOG_message<BR />| stats values(device_ip) by _time SYSLOG_mne SYSLOG_message<BR /><BR /></P> Mon, 25 Jan 2021 17:15:52 GMT https://community.splunk.com/t5/Reporting/Search-Optimization-on-my-query/m-p/537083#M8710 bapun18 2021-01-25T17:15:52Z https://community.splunk.com/t5/Reporting/Search-Optimization-on-my-query/m-p/537110#M8711 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/204073">@bapun18</a>,</P><P>Please try this below;</P><LI-CODE lang="markup"> index=syslogs earliest=-5m | lookup my_devices_lookup device_ip as host OUTPUTNEW device_ip as found | where isnull(found) | stats values(device_ip) by _time SYSLOG_mne SYSLOG_message</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 25 Jan 2021 19:57:38 GMT https://community.splunk.com/t5/Reporting/Search-Optimization-on-my-query/m-p/537110#M8711 scelikok 2021-01-25T19:57:38Z