Reporting

report acceleration - memory usage

lukasz92
Communicator

Hi,

I am looking for answer to two questions:

1) How command | savedsearch provides results if the report has time input, and I select wider range in my query?
This report defaults to Last 24 hours with search, and has 3 months accelerated.

2) How to debug extremly high memory usage (over 12 GB) on searchhead if I start a query and run it for last 30 days?

Report search looks like: index="wineventlog" host=* (EventID=4688 OR EventID=861) NewProcessName=* SubjectUserName=* | rename SubjectUserSid as user, NewProcessName as process | lookup whitelist_win process | fillnull active | stats sparkline(count) AS timeline, max(active) AS active by host, user, process
My search which use this report is | savedsearch "WinRunningApps"

This lookup is small, and has a wildcard matching.

0 Karma

cmerriman
Super Champion

for the time range portion, if you select a new time range in the time picker, it overrides the range saved in the saved search. you can see that under Time ranges in the documentation
https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Savedsearch

one thing that might help make this more efficient is to aggregate the results before the lookup, if possible. you're joining your lookup to every single event, if you could narrow the number of rows it had to join to, that might help.

0 Karma

niketn
Legend

To add on to cmerriman's comment, following is the documentation on performing stats first and then lookup: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_sea...

Following rename can be moved to later part of the query (after stats), possibly the final command for formatting.

| rename SubjectUserSid as user, NewProcessName as process

PS: You do not need to match field names to perform lookup:

| lookup whitelist_win process  AS NewProcessName
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...