topic Re: Help with collect and searching stash files in Splunk Search

Help with collect and searching stash files

williamsweat — Sat, 02 Apr 2011 07:11:42 GMT

Hello,

I'm trying to use collect and the subsequent stash file to save time on a large search query. The documentation on collect, http://www.splunk.com/base/Documentation/4.2/SearchReference/Collect, doesn't mention how to then use the stash file.

It will then notify that it's saved to the stash file. How can I run a search on the stash?

Re: Help with collect and searching stash files

Ron_Naken — Wed, 06 Apr 2011 06:31:16 GMT

The data you pipe to the collect command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:

index=saved_results

Re: Help with collect and searching stash files

Ron_Naken — Wed, 06 Apr 2011 06:37:30 GMT

Note: You will need to create the respective index, prior to running the collect command.

Re: Help with collect and searching stash files

gkanapathy — Wed, 06 Apr 2011 10:12:02 GMT

let me note that your particular query is probably best improved not by using summary indexing, but instead by using the Splunk index:

index=some_index (NAME=values OR NAME=that OR NAME=are OR NAME=needed) (LV=errors OR LV=warning OR LV=critical)

index=some_index (NAME=*values* OR NAME=*that* OR NAME=*are* OR NAME=*needed*) (LV=errors OR LV=warning OR LV=critical)

or whatever is appropriate.

This should run considerably faster than your initial query and is far less complicated than generating a summary.

Re: Help with collect and searching stash files

williamsweat — Thu, 07 Apr 2011 00:17:44 GMT

Ah, thanks for the tips. It was for a fairly lengthy saved query (about 4800 chars) with a lot of NOT and OR's. I was testing to see if creating a summary index would help with performance.

Re: Help with collect and searching stash files

gkanapathy — Thu, 07 Apr 2011 07:52:19 GMT

A summary is really only going to help with post-processing, not retrieval, i.e., if you're doing stats, chart or timechart on results.