Reporting

how to speedup search machine data?

ugy
Explorer

Hello everyone... 🙂

My Data is under type...
|TAG01|TAG02|TAG03|
|434.1|444.0|42.7|
|420.1|424.5|40.6|
|470.3|453.8|43.5|
|452.6|413.6|40.4|
|429.3|419.3|44.7|

I'd like to check realtime data in Splunk Gauge, So, I use this search
"index=myindex | timechart latest(TAG01)"

How to speedup search?

If use accelation Report, Can i use latest or first?

Thanks.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're just displaying a single value, you should be able to speed up your realtime search like this:

index=myindex TAG01=* | tail 1 | table TAG01

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're just displaying a single value, you should be able to speed up your realtime search like this:

index=myindex TAG01=* | tail 1 | table TAG01

martin_mueller
SplunkTrust
SplunkTrust

For a line chart you're probably looking for something like this:

index=myindex TAG01=* | timechart avg(TAG01)

Report Acceleration can be enabled for this if you need to.

0 Karma

ugy
Explorer

I have two issue.
First Gauge View, Two Linechart View.
So, I have to use timechart.
Your First answer for Gauge View. Thank you.
I'd like to view Long time for timechart. So, I asked about timechart and accelation report.

Anyway! Your answer is Helpfull to me.
Thank you.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Why would you want to use timechart to feed a gauge? timechart gives you a series of values, for example one per minute, that's often charted using columns, lines, or areas. A gauge only displays one value.

The more important question is, what's your use case?

0 Karma

ugy
Explorer

First of all
Thank you for your answer.

If i'd like to use timechart or Accelation Report, how to use search?

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...