Report Acceleration on subsearch

ashleyherbert — Tue, 12 Nov 2013 23:28:24 GMT

Hi,
I'm trying to apply some search acceleration on a subsearch (using the join command), but I can't seem to get it working. Does anyone know if subsearches can be accelerated?

This is my saved accelerated search:

index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime

If I run the following search separately, the acceleration works perfectly. But when I use this same search within the join command, the search isn't accelerated.

Here's my full search:

index=prod sourcetype=odr | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval count=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",count) | eval Users=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",Users) | eval AvgTime=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",AvgTime) | eval date_wday=if(isnull(date_wday),lower(strftime(_time,"%A")),date_wday) | eval 10mintime=strftime(_time,"%T") | join date_wday, 10mintime [ search index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval 10mintime=strftime(_time,"%T") | eval hitsLowBand=count-(count*0.2) | eval hitsHighBand=(count+(count*0.2))-hitsLowBand | eval timeLowBand=AvgTime-(AvgTime*0.2) | eval timeHighBand=(AvgTime+(AvgTime*0.2))-timeLowBand | eval usersLowBand=Users-(Users*0.2) | eval usersHighBand=(Users+(Users*0.2))-usersLowBand ] | timechart span=10m first(hitsLowBand) as hitsLowBand, first(hitsHighBand) as hitsHighBand, first(count) as Hits, first(timeLowBand) as timeLowBand, first(timeHighBand) as timeHighBand, first(AvgTime) as AvgTime, first(usersLowBand) as usersLowBand, first(usersHighBand) as usersHighBand, first(Users) as Users

Thanks

Re: Report Acceleration on subsearch

HiroshiSatoh — Wed, 13 Nov 2013 06:07:30 GMT

The value of a main search is overwritten by the result of subsearch. Is it necessary to use a subsearch? I think that you should explain what report you want.

(_time),count,AvgTime,Users

topic Re: Report Acceleration on subsearch in Splunk Search

Report Acceleration on subsearch

Re: Report Acceleration on subsearch