https://community.splunk.com/t5/Splunk-Search/Pre-processing-Post-processing-while-loading-data/m-p/116008#M30799 <P>I use a lookup table to stash results from an expensive to enrich another query.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Lookup</A></P> <P>If that does not meet my need I speed things up with a time series index.</P> <P><A href="http://docs.splunk.com/Splexicon:Tsidxfile">http://docs.splunk.com/Splexicon:Tsidxfile</A></P> <P>The job inspector has all kinds of data about searches.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ViewsearchjobpropertieswiththeJobInspector">http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ViewsearchjobpropertieswiththeJobInspector</A></P> Fri, 30 Jan 2015 13:01:55 GMT thomrs 2015-01-30T13:01:55Z https://community.splunk.com/t5/Splunk-Search/Pre-processing-Post-processing-while-loading-data/m-p/116007#M30798 <P>Sorry if this question lacks objectivity.</P> <P>Basically, in my current SPA webapp, I am making three queries to Splunk that has CSV data loaded. The queries calculate a lot time differences and do string operations on the fields. Unfortunately, a big part of these three queries involves <STRONG>exact</STRONG> repeated sections involving these operations.</P> <P>I want to improve the query time by avoiding these repetitive calculations. I was wondering if there are ways in which during loading the data:<BR /> - Either I can pre-process some of the field to add more fields .<BR /> - OR After getting data loaded, post-process the fields to add more fields. </P> <P>I am also trying to get an exact breakup of query time in terms of actual <EM>query processing time</EM> and <EM>network transfer time</EM> to fetch the data.</P> <P>Any suggestions !</P> Fri, 30 Jan 2015 12:29:47 GMT https://community.splunk.com/t5/Splunk-Search/Pre-processing-Post-processing-while-loading-data/m-p/116007#M30798 mohitab 2015-01-30T12:29:47Z https://community.splunk.com/t5/Splunk-Search/Pre-processing-Post-processing-while-loading-data/m-p/116008#M30799 <P>I use a lookup table to stash results from an expensive to enrich another query.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Lookup">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Lookup</A></P> <P>If that does not meet my need I speed things up with a time series index.</P> <P><A href="http://docs.splunk.com/Splexicon:Tsidxfile">http://docs.splunk.com/Splexicon:Tsidxfile</A></P> <P>The job inspector has all kinds of data about searches.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ViewsearchjobpropertieswiththeJobInspector">http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ViewsearchjobpropertieswiththeJobInspector</A></P> Fri, 30 Jan 2015 13:01:55 GMT https://community.splunk.com/t5/Splunk-Search/Pre-processing-Post-processing-while-loading-data/m-p/116008#M30799 thomrs 2015-01-30T13:01:55Z