All Apps and Add-ons

Why does the tSessions_Lookup_Update report take a long time to complete?

Motivator

The tSessions_Lookup_Update report from the splunk_app_windows_infrastructure is the main or only report for which we see many skipped searches.

The code is -

`tsessions` 
| eval _key = session_id 
| sort 0 _time 
| outputlookup tSessions append=true

| inputlookup tSessions is not even responsive.

What can it be?

0 Karma

Motivator

Looking via the MC at search->kvstore->instance and we see -

alt text

We see 268,809,800 objects for this collection. Does it make sense to have so many objects? Should we maybe initialize this collection?

0 Karma