Searching using timechart is too slow

xsstest — Thu, 25 Jan 2018 12:28:07 GMT

I have a index naming is "IDS" . It's has 4 sourcetypes.
The event of the index is very large. an average of 1.3 million events in 10 minutes
I want to use timechart to show every 4 hours IDS alert trend. (on dashboard)
but timechart is too slow. Is there a faster search?

Below is my search:

index=IDS 
|eval ids=case(sourcetype="WAN-http" OR  sourcetype="WAN-ids","WAN",sourcetype="LAN-http" OR sourcetype="LAN-http","LAN")
|timechart count by ids

Re: Searching using timechart is too slow

FrankVl — Thu, 25 Jan 2018 12:38:06 GMT

Since the case statement in your eval is based on sourcetype, you're effectively doing a count by sourcetype. That can be done much faster using tstats.

| tstats count where index=IDS by sourcetype,_time
| eval ids=case(sourcetype="WAN-http" OR  sourcetype="WAN-ids","WAN",sourcetype="LAN-http" OR sourcetype="LAN-http","LAN")
| timechart sum(count) by ids

topic Searching using timechart is too slow in Splunk Search

Searching using timechart is too slow

Re: Searching using timechart is too slow