Hi
I have the below code, however, as I grow the number of lines I am giving the MAP is it getting very slow.
Is there any way to run the map in parallel?
| map maxsearches=21 search="| savedsearch "$ALERT$" host_token=PDT SERVICE_EARLIEST_TIME=1643954400 time_token.earliest=1644213600 time_token.latest=1644268200 Threshold=$Threshold$ | appendcols [ | makeresults | eval Order="$Order$",Threshold=$Threshold$ | fillnull count ] | table ALERT count Order Threshold "
Thanks in advance
Rob
Hey,
did you find a solution?
Best regards
Hi
No sorry, i did not.
Rob