Solved: Re: Stats Calculate Time Taken to Copy the Indexes - Page 2

praneethlekkala · ‎05-03-2021

Our Application does a nightly re-index on node 1, once thats complete, the index build is copied to 6 other nodes, Each of the other nodes then restore the files. These entries are noted as "Index restore started." and "Index restore complete." in the application logs. I would like to have a dashboard panel that shows how long it takes from "started" to "complete" on each host to be able to see trends for this over time. How to go about this?

ITWhisperer · ‎05-04-2021

--- search
| eval starttime=if(match(_raw,"Index restore started"),_time,null)
| eval completetime=if(match(_raw,"Index restore complete"),_time,null)
| stats latest(starttime) as starttime latest(completetime) as completetime by host

View solution in original post

praneethlekkala · ‎05-04-2021

Stats Calculate Time Taken to Copy the Indexes

panel

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

May 2026 Splunk Expert Sessions: Security & Observability

Network to App: Observability Unlocked [May & June Series]

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Join the Conversation