Developing for Splunk Enterprise

Splunk SDK Search is slow

TheMilkMan
New Member

The Splunk query using Splunk SDK using C# returns results much slower than the front end.

Query

index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }
Labels (1)
Tags (3)
0 Karma

wmyersas
Builder

What is your search?

How are you connecting with the SDK?

0 Karma

TheMilkMan
New Member

index=TEST "

0 Karma

TheMilkMan
New Member
index=TEST "<TEST LogTime" earliest="11/1/2019:0:0:0" latest="11/30/2019:23:59:59" | where (in(Field1, "TestValue1","TestValue2","TestValue3")) | fields TestField1 TestField2 TestField3 | rename TestField1 as TestField1a, TestField2 As TestField2b, TestField3 As TestField3a

using (var service = new Service(Scheme.Https, _config.Uri, _config.Port))
                {

                    await service.LogOnAsync(_config.Username, _config.Password);

                    using (var searchResultStream = await service.SearchOneShotAsync(query))
                    {

                        var config = new MapperConfiguration(cfg => { });
                        var mapper = config.CreateMapper();
                        foreach (var result in searchResultStream)
                        {
                            results.Add(mapper.Map<T>(result));
                        }
                    }
                }
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!