Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

robertlynch2020 — Mon, 20 Nov 2023 10:45:58 GMT

Hi - Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

I am using "appendcols", but I think one is waiting for the other to finish.

I can't use multisearch as I don't have stream commands.
The issue is displaying the license used by Splunk and I want to run 2 SPL in parallel. However, it's very slow to run if I run 2 in sequence. Thanks in advance for any help

index=_internal [ `set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | search pool = "*" | search idx != "mlc_log_drop" | timechart span=1d sum(b) AS Live_Data fixedrange=false | fields - _timediff | foreach * [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | appendcols [ search index=_internal [ `set_local_host`] source=*license_usage.log* type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | search pool = "*" | search idx = "mlc_log_drop" | timechart span=1d sum(b) AS Log_Drop_Data fixedrange=false | fields - _timediff | foreach * [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)]]

Re: Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

PickleRick — Mon, 20 Nov 2023 11:16:30 GMT

You're asking a wrong question.

Your both searches start with the same base search so either you should be able to do all in one go or your searches produce differently aggregated results so it doesn't make sense to combine them with appendcols.

Re: Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

robertlynch2020 — Mon, 20 Nov 2023 11:24:46 GMT

I agree that is correct and this was an example of 2 SPLs I had, but I had other issues else where the SPLs were different.

The UNION command was able to help me out in this case.

Thanks

Robert

topic Re: Is there a way to get 2 nonstream Searches to run in parallel in the same SPL? in Splunk Search

Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

Re: Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?

Re: Is there a way to get 2 nonstream Searches to run in parallel in the same SPL?