topic Re: Improve efficiency of a splunk search query in Splunk Search

How to improve efficiency of a Splunk search?

nilbak88 — Thu, 21 Apr 2022 14:43:22 GMT

Hi All,

One of my scheduled report is quite expensive.
It runs everyday from Monday to Friday and results in 30 days worth of data.

Search Query
index=abc_* | stats count by index,host

How can I improve its search efficiency?
Please suggest .

Re: Improve efficiency of a splunk search query

gcusello — Thu, 21 Apr 2022 12:17:29 GMT

Hi @nilbak88,

if in your search you have to use only index and host, you can use | metasearch for faster searches:

| metasearch index=abc_* | stats count by index host

for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Metasearch

Ciao.

Giuseppe

Re: Improve efficiency of a splunk search query

nilbak88 — Thu, 21 Apr 2022 12:57:33 GMT

Thanks @gcusello

That was really quick and helpful.
Also, is there is any possibility if we can modify time range setting in such a way that is do not overlap the data.

Like currently, its running everyday and resulting 30 days of data since time range is set as of 30 days.

Re: Improve efficiency of a splunk search query

ITWhisperer — Thu, 21 Apr 2022 13:21:03 GMT

You could put your daily counts into a summary index, then create a report which sums counts from the summary index for the last 30 days

Re: Improve efficiency of a splunk search query

gcusello — Thu, 21 Apr 2022 13:21:53 GMT

Hi @nilbak88 ,

if you want to fix the time range e.g. from the last 30 days to the end of yestarday, you could add some time modifiers like this:

| metasearch index=abc_* earliest=-30d@d latest=@d | stats count by index host

Ciao.

Giuseppe