https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299421#M175525 <P>Hello everyone!!!</P> <P>This is a search that I was used to setting up a report with acceleration. But in the Report Acceleration Summaries appear as 0% Complete since yesterday. I don't know if this search is elegible to report acceleration? Also any suggestions to speed up the search will be welcome.</P> <P>Thanks in advance.</P> <PRE><CODE>sourcetype=f5logs | eval page_type = case(match(http_uri,"html"),"PDP", match(http_uri,"\/l\/"),"PLP", match(http_uri,"\/api\/(?!user)"),"All API", match(http_uri,"\/api\/user(?!\/placeOrder)"),"User API", match(http_uri,"\/g\/"),"GLP", match(http_uri,"\/c\/"),"Category", match(http_uri,"\.gif|\.jpg|\.js|\.css"),"Assets", match(http_uri,"/api\/user\/placeOrder"),"PlaceOrder", match(http_uri_query,"searchinfo"),"Search", match(http_uri,"\/searchsite\/default\.aspx|\/catalog\.tpl|\^/$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"), "Home", match(http_uri,"^((?!html|\/l\/|\/api\/|\/g\/|\/searchsite\/default\.aspx|/catalog\.tpl|\^/$$|\/g\/|\/c\/|\.gif|\.jpg|\.js|\.css).)*$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"),"Others") | stats count by page_type </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2487iDCC74E4449A3C8CA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 14 Feb 2017 21:54:37 GMT aselios 2017-02-14T21:54:37Z https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299421#M175525 <P>Hello everyone!!!</P> <P>This is a search that I was used to setting up a report with acceleration. But in the Report Acceleration Summaries appear as 0% Complete since yesterday. I don't know if this search is elegible to report acceleration? Also any suggestions to speed up the search will be welcome.</P> <P>Thanks in advance.</P> <PRE><CODE>sourcetype=f5logs | eval page_type = case(match(http_uri,"html"),"PDP", match(http_uri,"\/l\/"),"PLP", match(http_uri,"\/api\/(?!user)"),"All API", match(http_uri,"\/api\/user(?!\/placeOrder)"),"User API", match(http_uri,"\/g\/"),"GLP", match(http_uri,"\/c\/"),"Category", match(http_uri,"\.gif|\.jpg|\.js|\.css"),"Assets", match(http_uri,"/api\/user\/placeOrder"),"PlaceOrder", match(http_uri_query,"searchinfo"),"Search", match(http_uri,"\/searchsite\/default\.aspx|\/catalog\.tpl|\^/$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"), "Home", match(http_uri,"^((?!html|\/l\/|\/api\/|\/g\/|\/searchsite\/default\.aspx|/catalog\.tpl|\^/$$|\/g\/|\/c\/|\.gif|\.jpg|\.js|\.css).)*$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"),"Others") | stats count by page_type </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2487iDCC74E4449A3C8CA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 14 Feb 2017 21:54:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299421#M175525 aselios 2017-02-14T21:54:37Z https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299422#M175526 <P><CODE>eval</CODE> and <CODE>match</CODE> are no problem here, that doesn't stop a search from being accelerate-able.</P> <P>Looking at your summarization load of basically 1, it appears there has been a summarization search running since you enabled the summary... give it time if you have a huge amount of data in that sourcetype.</P> Tue, 14 Feb 2017 23:06:10 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299422#M175526 martin_mueller 2017-02-14T23:06:10Z https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299423#M175527 <P>Thanks Martin for clarifying.</P> <P>I found the problem. !!!<BR /> The problem is with regular expression, substituting double <CODE>$$</CODE> with single <CODE>$</CODE> the report accelartion started to work. </P> <P>Thanks for your help.</P> Wed, 15 Feb 2017 21:00:05 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-search-with-eval-with-match-in-case-statement-elegible-to/m-p/299423#M175527 aselios 2017-02-15T21:00:05Z