Building for the Splunk Platform

Splunk SDK Search is slow

TheMilkMan
New Member

The Splunk query using Splunk SDK using C# returns results much slower than the front end.

Query

index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }
Labels (1)
Tags (3)
0 Karma

wmyersas
Builder

What is your search?

How are you connecting with the SDK?

0 Karma

TheMilkMan
New Member

index=TEST "

0 Karma

TheMilkMan
New Member
index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }
0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...