Can we convert to tstats?

[danielbb]

Hello,

Is there a way to convert this query to run with tstats? It is _slow_ when running it for two weeks of data...

index=index_name host=IP_name
| eval lag_sec = (_indextime - _time)
| eval lag_min = lag_sec/60
| timechart span=1h avg(lag_min)

[gcusello]

Hi @danielbb,

if you have so many events that your search is very slow, you could think to schedule your search every night, saving results in a summary index and then run your search on the summary index, something like this:

Scheduled search:

index=index_name host=IP_name earliest=-d@d latest=@d
| eval lag_sec=(_indextime-_time)
| eval lag_min=lag_sec/60
| timechart span=1h avg(lag_min) AS avg_lg_min
| collect index=my_summary

your new search:

index=my_summary
| table orig_time avg_lg_min

At the same time I'd analyze the performaces  of your storage. has it at least 800 IOPS?

Ciao.

Giuseppe

[burwell]

There's a big discussion here https://community.splunk.com/t5/Splunk-Search/How-to-compute-indextime-time-difference-average-with-...