Splunk Enterprise

Same query send to Splunk multiple times

xxmazurt
New Member

Hello,

I have an external script which sends queries to Splunk via API. My script sends 10 identical query same time. In jobs inspector, I see them as 10 different inputs. I assume that because they are run in parallel, they consume search head resources discretely.

The question is: if there is any mechanism in Splunk which could recognize that identical queries were sent to Search Head and optimize queries execution?

Tags (1)
0 Karma

s2_splunk
Splunk Employee
Splunk Employee

I have to ask: Why does your script send 10 identical queries at the same time? What are you trying to achieve?

0 Karma

woodcock
Esteemed Legend

No, but what you can do is save the search in Splunk, schedule it to run in the scheduler and then pull in the results using the loadjob command. This pulls just the results from the previous run so it uses no search resources and doesn't matter if you call it 10 times.

0 Karma

jkat54
SplunkTrust
SplunkTrust

If by optimize you mean deduplicate the 10 indentical searches into just 1 search, no there is no mechanism to do this in Splunk.

Closest option I can think of is saving a report, scheduling it to run every so often, and then pulling the results of the saved report. That would give you the same results until the report's scheduled run time came up again.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...