Splunk IT Service Intelligence

Splunk API functionality- How to improve minimum response time?

mani0525
New Member

I'm attempting to use Splunk's API to extract some data. My configuration includes a max_count of 1, a search string with an index, oneshot execution (due to the nature of the design), earliest and latest execution times of 2 minutes, and json output as the output mode. Minimum response time is 12 seconds. Is there anything I could do differently to improve it?

I experimented with changing the search query's time limit to one minute and adding extra filters. I've tried both blocking and alternative normal exec_modes.

Labels (1)
0 Karma

srauhala_splunk
Splunk Employee
Splunk Employee

Are you able to try you search in splunk web does it take the same amount of time there? 

 

/Seb 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...