report acceleration - memory usage

[lukasz92]

Hi,

I am looking for answer to two questions:

1) How command | savedsearch provides results if the report has time input, and I select wider range in my query?
This report defaults to Last 24 hours with search, and has 3 months accelerated.

2) How to debug extremly high memory usage (over 12 GB) on searchhead if I start a query and run it for last 30 days?

Report search looks like: index="wineventlog" host=* (EventID=4688 OR EventID=861) NewProcessName=* SubjectUserName=* | rename SubjectUserSid as user, NewProcessName as process | lookup whitelist_win process | fillnull active | stats sparkline(count) AS timeline, max(active) AS active by host, user, process
My search which use this report is | savedsearch "WinRunningApps"

This lookup is small, and has a wildcard matching.

[cmerriman]

for the time range portion, if you select a new time range in the time picker, it overrides the range saved in the saved search. you can see that under Time ranges in the documentation
https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Savedsearch

one thing that might help make this more efficient is to aggregate the results before the lookup, if possible. you're joining your lookup to every single event, if you could narrow the number of rows it had to join to, that might help.

[niketn]

To add on to cmerriman's comment, following is the documentation on performing stats first and then lookup: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_sea...

Following rename can be moved to later part of the query (after stats), possibly the final command for formatting.

| rename SubjectUserSid as user, NewProcessName as process

PS: You do not need to match field names to perform lookup:

| lookup whitelist_win process  AS NewProcessName