Splunk Search

Accelerate transaction searches

horacechan
New Member

Hi,

I am fairly new to Splunk. Is there a way to accelerate searches that use the 'transaction' command? Whenever I try to save this as accelerated search, it fails to save.

index=myidx sourcetype="my-logs" (jobtype OR appid) | transaction tid keepevicted=true maxspan=180 | fillnull value=null appid | stats count by jobtype, appid

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That search does not qualify for Report Acceleration due to the non-streaming transaction command being used before the first transforming command (stats😞 http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Manageacceleratedsearchsummaries#Example...

martin_mueller
SplunkTrust
SplunkTrust

Without knowing the data or your requirements for the result, same way as speeding up any other search. Filter as much as possible as early as possible, restrict timeranges, consider summarizing searches, etc.

0 Karma

horacechan
New Member

Thanks for you quick response.

Do you know of a good way to speed up the "transaction" command?

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...