Reporting

Is there a way to use the sort command in a search, but still accelerate the report?

Motivator

Hi,

I wonder whether someone may be able to help please.

I'm using the search below to return a given number of statistics.

auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=*  
 |  replace "true" with "Opted In", "false" with "Opted Out" in detail.input-preference-digital 
 | sort 0 detail.input-utr,-_time |eval inOrOut='detail.input-preference-digital' 
 | stats first(inOrOut) As inOrOut By detail.input-utr  
 | chart count by inOrOut 
 | eval pieSlice=inOrOut  + " " + count  
 |fields pieSlice, count

The problem I have is that I want to 'Accelerate' the report, but I know, from advice I've been given on this forum, that I can't because of the 'sort' command.

Could someone tell me please is there a way to use both the 'Sort' command and 'Accelerate' the report.

Many thanks and kind regards

Chris

Tags (3)
0 Karma
1 Solution

Legend

You don't need the sort because the following stats command automatically sorts on the fields in the by clause. This will work

 auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=*  
| rename "detail.input-preference-digital" as inOrOut
| replace "true" with "Opted In", "false" with "Opted Out" in inOrOut
| stats first(inOrOut) As inOrOut By detail.input-utr  
| chart count by inOrOut 
| eval pieSlice=inOrOut  + " " + count  
| fields pieSlice, count

I also exchanged one of the eval commands with a rename, which is faster. You should see a speed improvement with the updated search. And this search should accelerate.

View solution in original post

Legend

You don't need the sort because the following stats command automatically sorts on the fields in the by clause. This will work

 auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=*  
| rename "detail.input-preference-digital" as inOrOut
| replace "true" with "Opted In", "false" with "Opted Out" in inOrOut
| stats first(inOrOut) As inOrOut By detail.input-utr  
| chart count by inOrOut 
| eval pieSlice=inOrOut  + " " + count  
| fields pieSlice, count

I also exchanged one of the eval commands with a rename, which is faster. You should see a speed improvement with the updated search. And this search should accelerate.

View solution in original post

Motivator

Hi @Iguinn, thank you once more for taking the time to reply to my post and for the guidance.

Many thanks and kind regards

Chris

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!