Splunk Search

Acceleration not working...

dcasey
Engager

Struggling with this query in Splunk ES. The results come back fine but take a long time to generate. Tried to accelerate it but got an error stating that it can't be accelerated. I have many accelerated queries that use the timechart command (a requirement for accelerated reports), but they were all on Splunk base. First time trying to do this on the ES installation. Any ideas on what is preventing it from being accelerated?

FYI - The query is intended to look back 12 months (year to date) and display a vertical graph of all events closed by severity in ES.

notable | search status_label="Closed" OR status_label="Resolved" | eval severity_status=severity.":".status_label | fillnull value="unknown" | timechart span=1mon count by severity_status | rename "informational:Closed" AS "Informational","low:Closed" AS "Low","medium:Closed" AS "Medium","high:Closed" AS "High","critical:Closed" AS "Critical"

Tags (2)

xwang_splunk
Splunk Employee
Splunk Employee

either find a way to remove your |fillnull pipe, or adding a list of fields to your |fillnull pipe. Then the check can pass.

0 Karma

sowings
Splunk Employee
Splunk Employee

In short, because the acceleration of searches look to reduce the overall result set, and certain search commands disqualify a search for acceleration. In this case, there's a lot packed into that `notable` macro which is doing a lot of per-event filtration / eval, etc. Because of all of that per event manipulation, the parser knows that it can't effectively accelerate the search.

Further, the place that gets you to having the "status_label" field is also jammed with macro goodness. In particular we have to consult several lookups to ascertain the current state of the event; this isn't indexed data at this point, so it's also not a candidate for acceleration.

There may be a way, however, to short-circuit some of the parts of that query to get you to what you want more directly. I'll do some fiddling on my local instance and see what I can come up with.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...