REST API tstats results slow

zubairaizatron — Sun, 30 Jan 2022 23:15:09 GMT

Hi guys

I am definitely a splunk novice. I want to run a search with the splunk REST API. it is a tstats on a datamodel. the issue i am facing is that the result take extremely long to return.

when i run the same search on the front end its extremely fast but via the rest API for 3 results it takes between 7-10 min where as on the front end it returns the results quickly.

my search is structured as follows:

https://<server>:8089/services/search/jobs -d " search= | tstats summariesonly=1 values(<value>) (there are a few values after this) from datamodel=<datamodel name> WHERE (some values for the values option before the from) | head 3" -d earliest= -5m@m -d latest =now -d output_mode=json

So when running an index search on which the datamodel is built (which is slower on the front end) it returns results as soon as i run the /results endpoint but the datamodel search takes extremely long.

Any ideas as to what my problem could be. The search does eventually return the results but it takes very long for the result size im requesting.

topic REST API tstats results slow in Splunk Search

REST API tstats results slow