help on subsearch with join command

[jip31]

hi

I need to improve the subsearch below

I explain : the piece of code in the subsearch count the number of core of the machine

So this count is always the same no matter the time

So I wonder if it would better to put these results in a csv lookup and to query the csv lookup instead to query on the index?

or is there some other tracks for improve this search?

Thanks

index=toto sourcetype=tutu type=* runq 
| fields host _time runq type 
| stats max(runq) as runq by host _time 
| join host 
    [ search index=toto sourcetype=tutu type=* 
    | fields host cpu_core
    | search host=1328 
    | stats max(cpu_core) as nbcore by host ] 
| eval Vel = (runq / nbcore) 
| eval _time = strftime(_time, "%d-%m-%y %H:%M:%S") 
| sort - _time 
| rename host as Host, _time as Heure 
| table Heure Host Vel 
| sort - Vel

[isoutamo]

Hi

using lookup instead of query "static" values from index is almost always better/more efficient way.

There are many conf presentation which cover this issue. In most cases you should avoid to use join and instead use stats. Here is some links to those 

• https://conf.splunk.com/files/2020/slides/TRU1761C.pdf
• https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo

[jip31]

Hi, many thanks