Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
I took the liberty of editing your question, to put the search code as code, such that special characters like * don't disappear.
Couple of observations
!=
filters, including also wildcards. Such negative filters are significantly slower than positive filters.stats count as release1
which you then join with the second part, which ends with table Percent
. Can you perhaps explain what you are trying to achieve here? It doesn't make a whole lot of sense to me. ]
be before the | eval Percent...
part?So apart from the general remark on the !=
filters, I think we need some more explaining on what you are trying to achieve, before anyone can give a proper answer on how to improve your query.
append
and join
aren't meant to be used like that.
earliest=1520640000 latest=1531526400
(index=app host="prod*" AND host= "*web*" OR host= "*wap*" _raw!="" AND _raw!="*sql*" AND exception!="*db2*" AND exception !="*solr*" error) OR
(index=app host="prod*" MQ _raw="*ERROR*" _raw!="*INFO*") OR
(index=app host="prod*" exception="*sql*" sqlserver OR db2) OR
(index=datatier riak sourcetype=kvs_console "\[error\]" host="prod*") OR
(index=datatier host="*prod*" source="*memsql*" "ERROR") OR
(index=datatier OR index=app sourcetype="solr_log" SEVERE OR ERROR)
| stats count(eval(_time < 1526688000)) as release1 count(eval(_time >= 1526688000)) as release2
| eval Percent = ((release2-release1)/ release1)*100 |table Percent
This will search your data in one go and count right away, instead of appending huge lists of raw data to each other
The next step is to figure out which part is taking up too much time. Run each segment individually:
earliest=1520640000 latest=1531526400
(index=app host="prod*" AND host= "*web*" OR host= "*wap*" _raw!="" AND _raw!="*sql*" AND exception!="*db2*" AND exception !="*solr*" error)
| stats count
Post the resulting count plus these values from the job inspector: scan count, run duration (or run time?).