Archive

Search job inspector discrepancies

responsys_cm
Builder

I have a search inputs a fairly large lookup table (150 MB). The execution costs are shown as:

Execution costs

Duration (seconds) Component Invocations Input count Output count

21.608 command.inputlookup 1 - 450,000

0.001 dispatch.check_disk_usage 1 - -

0.001 dispatch.createProviderQueue 1 - -

0.004 dispatch.evaluate 1 - -

0.004 dispatch.evaluate.inputlookup 1 - -

0.005 dispatch.writeStatus 5 - -

0.053 startup.handoff 1 - -

But the message the top says:

This search has completed and has returned 402,461 results by scanning 0 events in 46.318 seconds.

If the execution costs are barely adding up to 22 seconds, why is the whole search taking 46 seconds? What accounts for the other 24 seconds?

Thanks.

C

Tags (1)
0 Karma

drrushi_splunk
Splunk Employee
Splunk Employee

Is that the complete Search Inspector output? It seems incomplete. What version of Splunk is this?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!