topic Re: Make search faster in Splunk Search

Make search faster

tgdvopab — Thu, 10 Mar 2016 10:56:45 GMT

Hello

I have the following search:

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1" |  timechart avg(Value) as Value by host |  appendcols  [search index=test  sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold | search id="1"  |  bucket _time span=5min |  timechart values(threshold) as "threshold"]

The problem is, that the search takes too much time.
Is there a way to make the search faster?

Thanks 🙂

Re: Make search faster

JMichaelis — Thu, 10 Mar 2016 17:14:28 GMT

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up.

Re: Make search faster

somesoni2 — Thu, 10 Mar 2016 17:21:47 GMT

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

Re: Make search faster

tgdvopab — Fri, 11 Mar 2016 11:47:37 GMT

Thanks a lot for your solution! The search ist very fast now.
Could you explain me, what "appendpipe" and at the end "table" does?

Re: Make search faster

somesoni2 — Fri, 11 Mar 2016 15:28:10 GMT

Since, your first query aggregates based on host and time but second query does only by time, the query before appendpipe is doing summary of both value and threshold (I assume threshold is constant for a host) and appendpipe generate a summary just of time (no host). The eval inside appendpipe subsearch ensure threshold be added as host so that a column/series can be generated by the subsequent timechart.

The last table just does the column ordering _time, "all hosts", threshold