Splunk Search

Performance Issues with a search command line

dmorio
New Member

Hello,
I am beginning in Splunk and am told to resolve some calculation times issues using searches.
The functionnality should do the following :
The first of the month, for example "2013, April 1st", it gets the applicative monthly logs from index "test" for January, February, March. Here is the search syntax :

index="test" sourcetype="test_source_type" | timechart span=1mon eval(round(count(),0)) by httpDomain | addtotals | rename _time AS Time | eval Time=strftime(Time, "%B %y")

A dashboard display the differents values grouped by Month.

The problem is that the processing time is extremely high because the search is on All Indexed Data. I know there are several possibilities, (using Collect command to create Archive index, accelerate mode, ...) but I cannot implement this in a good way.
Would you have some ideas please ? A good practice ? It could be very helpfull.

The Splunk System is 4.2.5

I am ready to send some more informations or print screens when necessary

Thank you and best regards.

David

Tags (1)
0 Karma

Lucas_K
Motivator

For large time ranges + larger amounts of data you should use summary indexing to pre-process your events into statistics.

In a nutshell your spreading out the computational cost over time. Alternatively look at increasing the efficiency of your search by limiting the raw events that your first search (the one before your first pipe). The less raw results required by the search the faster it will run.

How long does your search take to run currently?

If this is a search that will be run via a dashboard (ie. its not just a once off) then definitely use summary indexing.

More info on summary indexing here : http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...