Archive

Can we improve on a standard index=index_name sourcetype=*prod | stats query?

Ultra Champion

We have this standard query -

index=<index name> sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd
|  stats count by  clientID apiName
|  eval applicationName=case(
clientID="<client_id>", "<nicer name>", 
....)
|  fields - clientID
|  fields applicationName apiName count
|  sort applicationName

Are there more performant options for such a query?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

if those are indexed extractions (at index or using datamodel acceleration) you can do this:

 |  tstats count where index=<index name> sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd by  clientID apiName
     |  eval applicationName=case(
     clientID="<client_id>", "<nicer name>", 
     ....)
     |  fields - clientID
     |  fields applicationName apiName count
     |  sort applicationName

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

if those are indexed extractions (at index or using datamodel acceleration) you can do this:

 |  tstats count where index=<index name> sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd by  clientID apiName
     |  eval applicationName=case(
     clientID="<client_id>", "<nicer name>", 
     ....)
     |  fields - clientID
     |  fields applicationName apiName count
     |  sort applicationName

View solution in original post

0 Karma

Ultra Champion

Much appreciated @adonio.

0 Karma

Ultra Champion

Very interesting @adonio - thank you.

0 Karma

Super Champion

i MAY be mistaken, but if you put fields at the beginning, it might be helpful, so splunk only grabs relevant fields and isn't looking at anything else.
index= sourcetype=prod clientID=aaa OR clientID=bbbb OR clientID=ccc OR clientID=ddd
| fields clientID apiName
| stats count by clientID apiName
| eval applicationName=case(clientID="", "", ....)
| fields - clientID
| sort applicationName

Ultra Champion

Makes perfect sense @cmerriman!!

0 Karma