topic Can this query be written more efficiently? in Splunk Search

Can this query be written more efficiently?

dfexsplunk — Tue, 29 Sep 2020 10:59:44 GMT

It's a query for a staked column chart.

Re: Can this query be written more efficiently?

sundareshr — Mon, 19 Sep 2016 15:55:52 GMT

Try this
*UPDATED*

index=myCompIn source="/locatedin/mySrc.log" "Reply Back" "CAT-IN | 91.8.1952.7.4" | timechart span=1d  count(eval(match(_raw, "SOME STUFF")) as A count(eval(RT_DCC_TYPE="converted")) as B

Re: Can this query be written more efficiently?

dfexsplunk — Tue, 20 Sep 2016 08:26:24 GMT

Thanks for this sundareshr but no luck with it, I get the following error "Error in 'timechart' command: Repeated group-by field '_time'."

Re: Can this query be written more efficiently?

sundareshr — Tue, 20 Sep 2016 11:44:43 GMT

Try the updated answer.

Re: Can this query be written more efficiently?

dfexsplunk — Tue, 20 Sep 2016 13:57:30 GMT

Tanx. Still the same error code produced.

Re: Can this query be written more efficiently?

sundareshr — Tue, 20 Sep 2016 14:14:43 GMT

🙂 try this time

Re: Can this query be written more efficiently?

dfexsplunk — Tue, 20 Sep 2016 14:20:19 GMT

Tanx. This runs without error but does not find any results!

Re: Can this query be written more efficiently?

sundareshr — Tue, 20 Sep 2016 14:31:52 GMT

Do you get any data back when you remove the last segment (timechart)?

Re: Can this query be written more efficiently?

somesoni2 — Tue, 20 Sep 2016 15:15:47 GMT

Try this

index=myCompIn source="/locatedin/mySrc.log" ("Reply Back" "CAT-IN " "SOME STUFF") OR ("CAT-IN | 91.8.1952.7.4 | (false true false)" ) OR ("CAT-IN | 91.8.1952.7.4 | (false false true)") OR ( RT_DCC_TYPE=converted ) OR ( "CAT-IN | 91.8.1952.7.4 | (false true false)") OR ( "CAT-IN | 91.8.1952.7.4 | (false false true)" ) 
| eval catin=case(searchmatch("CAT-IN | 91.8.1952.7.4 | (false true false)",1,searchmatch("CAT-IN | 91.8.1952.7.4 | (false false true)",1,true(),0)
| eval aTXN=if(searchmatch("\"Reply Back\" \"CAT-IN \" \"SOME STUFF\""),1,0) + catin
| eval bTXN=if(searchmatch("RT_DCC_TYPE=converted"),1,0) + catin
| timechart span=1d sum(aTXN) as aTXN sum(bTXN) as bTXN

Re: Can this query be written more efficiently?

dfexsplunk — Tue, 20 Sep 2016 16:23:37 GMT

This worked exactly. Tanx very much.