Re: | datamodel query taking too long

havatz · ‎10-01-2020

Hi

My query taking too long.. and its

| from datamodel:Intrusion_Detection.IDS_Attacks
| where _time>relative_time(now(),"-10s@s")
| stats values(tag) as tag,dc(signature) as count by src | where count>25

And it seems it will never return output

any idea?

richgalloway · ‎10-01-2020

What is the time window being searched? How large is the data set being searched? Why use where instead of selecting -10s from the time picker?

---
If this reply helps you, Karma would be appreciated.

| datamodel query taking too long

data model

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

| datamodel query taking too long

data model

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever