topic Can you help me break my search up into two smaller ones? in Splunk Search

Can you help me break my search up into two smaller ones?

bealm — Tue, 23 Oct 2018 22:01:37 GMT

I have a query that is taking up too many resources I am told. I decided to break it up into two smaller reports (one for the first 12 hours yesterday, one for the last 12 hours yesterday).

How do I add this to the query without using the drop down options or manually changing the period of time? Current report:

index=main source="/var/log/bwi/lanwan" VIP="*prod*" VIP=*etw* CN="*" | rex field=_raw "(^.*protocol=|^.*\s(via).*\snegotiated\sProtocol\s)(?<Protocol>.*?)\s(cipher=|with\sCipher\s)(?<Cipher>\w+-*\w*)" | dedup CN | rename CN AS PropertyNumber, OU AS PropertyName | eventstats max(time_in_sec), min(time_in_sec) avg(time_in_sec), first(_time) as latest_time by PropertyNumber | table PropertyNumber,PropertyName,Protocol,Cipher,_time

Re: Can you help me break my search up into two smaller ones?

cmerriman — Tue, 23 Oct 2018 23:05:23 GMT

you should just be able to do earliest=-1d@d latest=-1d@d+12h and earliest=-1d@d+12h latest=@d in the base search for the two separate searches

Re: Can you help me break my search up into two smaller ones?

mstjohn_splunk — Wed, 24 Oct 2018 21:47:35 GMT

hi @bealm,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

Re: Can you help me break my search up into two smaller ones?

bealm — Thu, 25 Oct 2018 13:25:23 GMT

I am awaiting my team to introduce this as a solution -- I believe strongly it will work but I may not know for a day or so... when I find out that it has worked I will complete this properly.. I would like to leave it open for now