topic Re: How to make my simple timechart search run faster? in Splunk Search

How to make my simple timechart search run faster?

adamsmith47 — Thu, 16 Mar 2017 20:03:04 GMT

I'm guessing this should be a very basic task, if it's possible.

My current search below produces exactly what I want, but is too slow:

index=<myindex> sourcetype=<mysourcetype> earliest=-7d@d| timechart span=1h count

However, the individual events are large (sometimes hundreds of lines), the event counts are large (several hundred thousand), and there are dozens of field extractions occurring for these events, so, the search takes a while to complete.

In an effort to make it faster, I'm using this with success (about 1/8th the time to complete):

index=<myindex> sourcetype=<mysourcetype> earliest=-7d@d | fields + index sourcetype| timechart span=1h count

However, I'm wondering if there's an easy, faster way to accomplish the same thing. Perhaps with tstats?

Any help is appreciated.

Re: How to make my simple timechart search run faster?

adonio — Thu, 16 Mar 2017 20:37:30 GMT

| tstats count WHERE index = index sourcetype = sourcetype earliest = sometime BY _time
you can add span and other components to the command. More about | tstats here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Tstats

Re: How to make my simple timechart search run faster?

jethompson_splu — Thu, 16 Mar 2017 20:38:20 GMT

Hello adamsmith47,

You will want to setup an Accelerated Report. This will help to reduce the amount of time that it takes for this type of search to complete. The following is a link to the Documentation for setting up Accelerated Reports:

http://docs.splunk.com/Documentation/Splunk/latest/Report/Acceleratereports