https://community.splunk.com/t5/Splunk-Search/Best-way-to-obtain-event-counts-from-a-massive-search/m-p/36366#M8100 <P>This sounds like the perfect task for either summary indexing or report acceleration, depending on your specific needs and preferences.</P> Thu, 16 May 2013 14:48:05 GMT martin_mueller 2013-05-16T14:48:05Z https://community.splunk.com/t5/Splunk-Search/Best-way-to-obtain-event-counts-from-a-massive-search/m-p/36365#M8099 <P>Specifically, I am attempting to gather a count of firewall denies per day over an entire month. Running that search takes quite a long time. I am wondering if there is a more efficient way to perform this search than just performing the search and waiting for the results.</P> <P>sourcetype=cisco_asa eventtype=cisco_firewall eventtype=firewall_deny | count by dest_ip</P> <P>Is there a way to run the search for a one day period and store the count in a csv and then pull from the csv? Or is there something else?</P> Mon, 28 Sep 2020 13:55:07 GMT https://community.splunk.com/t5/Splunk-Search/Best-way-to-obtain-event-counts-from-a-massive-search/m-p/36365#M8099 rmcdougal 2020-09-28T13:55:07Z https://community.splunk.com/t5/Splunk-Search/Best-way-to-obtain-event-counts-from-a-massive-search/m-p/36366#M8100 <P>This sounds like the perfect task for either summary indexing or report acceleration, depending on your specific needs and preferences.</P> Thu, 16 May 2013 14:48:05 GMT https://community.splunk.com/t5/Splunk-Search/Best-way-to-obtain-event-counts-from-a-massive-search/m-p/36366#M8100 martin_mueller 2013-05-16T14:48:05Z