https://community.splunk.com/t5/Splunk-Search/How-can-I-resuse-the-output-of-a-query-to-compute-larger/m-p/642210#M222466 <DIV class=""><DIV class=""><DIV class=""><P>I am currently running a query that is quite inefficient, and it fails when run for extended periods.</P><P>Splunk only allows me to run it every 15 minutes, which is a limitation I have as a work around for now.</P><P>Unfortunately, I can't improve the situation because I don't have control over the log creation process as the logs come from a third party system</P><P>Currently, I'm running the query as an alert every 15 minutes, but I'd like to capture these metrics over a more extended period, such as 24 hours or more.</P><P>Is there a built-in mechanism in Splunk that can store and append the results of these queries for future reference?</P><P>I am aware that I could use the Java SDK to extract and aggregate the metrics outside of Splunk, but that approach is not ideal.</P></DIV></DIV></DIV> Thu, 04 May 2023 00:28:24 GMT yk010123 2023-05-04T00:28:24Z https://community.splunk.com/t5/Splunk-Search/How-can-I-resuse-the-output-of-a-query-to-compute-larger/m-p/642210#M222466 <DIV class=""><DIV class=""><DIV class=""><P>I am currently running a query that is quite inefficient, and it fails when run for extended periods.</P><P>Splunk only allows me to run it every 15 minutes, which is a limitation I have as a work around for now.</P><P>Unfortunately, I can't improve the situation because I don't have control over the log creation process as the logs come from a third party system</P><P>Currently, I'm running the query as an alert every 15 minutes, but I'd like to capture these metrics over a more extended period, such as 24 hours or more.</P><P>Is there a built-in mechanism in Splunk that can store and append the results of these queries for future reference?</P><P>I am aware that I could use the Java SDK to extract and aggregate the metrics outside of Splunk, but that approach is not ideal.</P></DIV></DIV></DIV> Thu, 04 May 2023 00:28:24 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-resuse-the-output-of-a-query-to-compute-larger/m-p/642210#M222466 yk010123 2023-05-04T00:28:24Z https://community.splunk.com/t5/Splunk-Search/How-can-I-resuse-the-output-of-a-query-to-compute-larger/m-p/642221#M222468 <P>Two things come to mind:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing" target="_blank" rel="noopener">Use summary indexing for increased search efficiency</A>, and&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Outputlookup#outputlookup" target="_blank" rel="noopener">outputlookup</A>.</P> Thu, 04 May 2023 04:47:35 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-resuse-the-output-of-a-query-to-compute-larger/m-p/642221#M222468 yuanliu 2023-05-04T04:47:35Z