Getting Data In

Why ResultsReaderJson taking more time to parse a simple stream returned by oneshotsearch?

santhoshpriyan
New Member

I am having an issue with consuming results using splunk API.

I am using a oneshotsearch where the result is returned immediately less than a second and using ResultrenderJson for parsing and it takes for almost 20 - 30 seconds for 3 results .

Sometimes if search a block of records for 1 day and it contains only 600~ records it will parse for hours and the search will only take 2 seconds.

Sample code
Args oneshotSearchArgs = new Args();
oneshotSearchArgs.put(SearchMode.OUTPUT_MODE.getMode(), OutputMode.JSON);
oneshotSearchArgs.put("count", 0);
inputstream is = service.oneshotSearch("myquery here", oneshotSearchArgs);
//this line takes more than time to execute
ResultsReaderJson resultsReader = new ResultsReaderJson(run);

Any Help would be greatly Appreciated.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...