topic Re: Optimizing a search in splunk in Splunk Search

Optimizing a search in splunk

gimbil — Mon, 04 Nov 2013 20:21:40 GMT

Hi,

I am trying to do a search which basically generates measures based on the value of a field such as X:

search logs|…..| timechart count(eval(X="1" OR X="2")) AS "A",  count(eval(X="1")) AS "B",  count(eval(X="2")) AS "C",  count(eval(X="3")) AS "D", count(eval(X="4" OR X="5" OR X="6")) as "E" span=1d

however, generating results takes for ever. If I remove some of the counts (like the one to generate "E") it becomes much faster. Is there anyway to better optimize this search?

Thanks

Re: Optimizing a search in splunk

somesoni2 — Mon, 04 Nov 2013 21:12:33 GMT

Try following

search logs|…..| eval countField=case(X="1" OR X="2","A",X="1","B",X="2","C",X="3","D",X="4" OR X="5" OR X="6","E",1=1,"E") | timechart count(eval(countfield="A"))AS "A", count(countfield="B") AS "B", count(eval(countfield="C")) AS "C", count(eval(countfield="D")) AS "D", count(eval(countfield="E")) as "E" span=1d

Re: Optimizing a search in splunk

ShaneNewman — Tue, 05 Nov 2013 00:52:52 GMT

The answer given by somesoni2 will make it more efficient. The other option is to create a summary index, then search the summary index.

Re: Optimizing a search in splunk

mdmaala — Tue, 19 Mar 2019 15:09:35 GMT

how to create a summary index and how will I call it in the search bar?

Re: Optimizing a search in splunk

kamlesh_vaghela — Mon, 25 Mar 2019 09:15:22 GMT

@mdmaala

Below link will help you.

https://github.com/packetiq/SplunkArchitect/blob/master/Creating-and-Using-Summary-Indexes.md