topic Re: How do I optimize the performance of my search that is currently using a different time range per sourcetype? in Splunk Search

How do I optimize the performance of my search that is currently using a different time range per sourcetype?

McJansen — Tue, 24 Nov 2015 06:32:10 GMT

Hi,

I have a performance issue concerning multiple time ranges in 1 search.
The search string is as follows:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 hoursago=24])

I choose for the timerangepicker the value: last 3 months.

Now this search will take ages.
The first part of the search isn't the problem, but the second one is.
It should be clear that I want all records from the first part and only the records from the last 24 hours from the last part.
The search above provide me with these, but the search takes ages.

My question is: isn't there a way to make this search faster?
I can't join because of the number of records (over 72 million) .

Thanx in advance!!

Re: How do I optimize the performance of my search that is currently using a different time range per sourcetype?

NOUMSSI — Tue, 24 Nov 2015 15:14:21 GMT

Hi,

Try this for your the second one:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])

Re: How do I optimize the performance of my search that is currently using a different time range per sourcetype?

McJansen — Wed, 25 Nov 2015 07:04:16 GMT

Sometimes I feel stupid! 😉

Thanx!!!!

Re: How do I optimize the performance of my search that is currently using a different time range per sourcetype?

NOUMSSI — Thu, 03 Dec 2015 23:42:35 GMT

Ok! please dont forget to vote me