https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199857#M57899 <P>Hi,</P> <P>I need a better search than this:</P> <PRE><CODE>index=shop sourcetype="source1" | chart count by action,productId | append [search index=shop sourcetype="source2" | chart count by action,productId] </CODE></PRE> <P>It is taking too much time to return results. Can someone help optimize my search?</P> Mon, 26 Oct 2015 11:50:08 GMT siddhu_93 2015-10-26T11:50:08Z https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199857#M57899 <P>Hi,</P> <P>I need a better search than this:</P> <PRE><CODE>index=shop sourcetype="source1" | chart count by action,productId | append [search index=shop sourcetype="source2" | chart count by action,productId] </CODE></PRE> <P>It is taking too much time to return results. Can someone help optimize my search?</P> Mon, 26 Oct 2015 11:50:08 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199857#M57899 siddhu_93 2015-10-26T11:50:08Z https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199858#M57900 <P>how about<BR /> index=shop | stats c(sourcetype) by action,productId<BR /> you can constrain it to specific source types too<BR /> index=shop (sourcetype=sourcetype1 OR sourcetype=sourcetype2)| stats c(sourcetype) by action,productId</P> Mon, 26 Oct 2015 13:02:23 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199858#M57900 mtranchita 2015-10-26T13:02:23Z https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199859#M57901 <P>index=shop (sourcetype=source1 OR sourcetype=source2)<BR /> | fields+ action, productId<BR /> | chart count by action, productId</P> Mon, 26 Oct 2015 13:03:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199859#M57901 HeinzWaescher 2015-10-26T13:03:19Z https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199860#M57902 <P>Why is it so slow? Is it purely the volume of data, or is it field extractions or what?</P> <P>To find out, please run the search over some reasonable amount of time, let it finish (or stop it) then click on the job inspector for the search. Post back what the largest few consumers of time are - a couple of them should stand out as "This is where the search's time is being spent."</P> <P>Also, compare the amount of time for the above search with the amount of time for the same search if you try running it in "Fast mode". (That's the drop down at the right side, "Fast mode", "Verbose mode" or "Smart mode".</P> <P>There are lots of solutions, which ones will work best for your particular problem is probably dependent on those answers. </P> Mon, 26 Oct 2015 13:04:47 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199860#M57902 Richfez 2015-10-26T13:04:47Z https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199861#M57903 <P>Not an answer, because you got some nice hints already. But check the slides from this <CODE>.conf</CODE> Session <A href="http://conf.splunk.com/session/2015/conf2015_JHarty_DuncanTurnbull_Splunk_UsingSplunkSearchLanguage_AQuickGuideToSearch.pdf">http://conf.splunk.com/session/2015/conf2015_JHarty_DuncanTurnbull_Splunk_UsingSplunkSearchLanguage_AQuickGuideToSearch.pdf</A> </P> Mon, 26 Oct 2015 21:25:14 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-optimize-the-performance-of-my-search/m-p/199861#M57903 MuS 2015-10-26T21:25:14Z