Splunk Search

Help combining multiple searches into one search WITH good performance

tyhopping1
Engager

I am in need of combining these three searches into one search:

1. 
      NameOfJob = BLT* | spath message | search message = " JOB STARTED" | spath Details | search Details = * | spath timestamp 
| search timestamp = *
        | stats earliest(timestamp) as StartTime, latest(timestamp) as EndTime  by NameofJob Details Description

2. 
    NameOfJob = BLT* | spath timestamp | search timestamp=*
        | stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob
        | eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S")
        | eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
        | eval duration=(EndTimeEpoch-StartTimeEpoch) | eval minutes = duration/60 | eval hours = minutes/60
        | eval StartTimeEpochD = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S")
        | eval EndTimeEpochD = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")

3. 
     NameOfJob = BLT* |  spath "countOfRecords" | search "countOfRecords"=*| spath timestamp | search timestamp=*
        | stats earliest(timestamp) as StartTime , latest(timestamp) as EndTime
         by countOfRecords NameOfRecords

I have already created a query that uses join (see below). However, it has very poor performance. The solution I am looking should not have poor performance.

My attempt (using join):

NameOfJob = BLT* | spath message | search message = "JOB STARTED" | spath Details | search Details = * | spath timestamp | search timestamp = *
| stats earliest(timestamp) as StartTime, latest(timestamp) as EndTime  by NameOfJob Details Description

| join type=outer NameOfJob 
[search NameOfJob = BLT* | spath timestamp | search timestamp=*
| stats min(timestamp) as StartTimeEpoch, max(timestamp) as EndTimeEpoch by NameOfJob

| join type=outer NameOfJob
[search NameOfJob = BLT* |  spath "countOfRecords" | search "countOfRecords"=*| spath timestamp | search timestamp=*
| stats earliest(timestamp) as StartTime , latest(timestamp) as EndTime
 by countOfRecords NameOfJob]

| eval StartTimeEpoch=strptime(StartTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpoch=strptime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")
| eval duration=(EndTimeEpoch-StartTimeEpoch) | eval minutes = duration/60 | eval hours = minutes/60
| eval StartTimeEpochD = strftime(StartTimeEpoch,"%Y-%m-%dT%H:%M:%S")
| eval EndTimeEpochD = strftime(EndTimeEpoch, "%Y-%m-%dT%H:%M:%S")]

This is all under the same index and source type
Any help is appreciated. Thank you!

0 Karma

arjunpkishore5
Motivator

Try this

|union
[ your query1]
[ your query2]
[ your query2]
|stats max(*) as * by NameOfJob

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...