Help with collect and searching stash files

[williamsweat]

Hello,

I'm trying to use collect and the subsequent stash file to save time on a large search query. The documentation on collect, http://www.splunk.com/base/Documentation/4.2/SearchReference/Collect, doesn't mention how to then use the stash file.

For example, this is the search query I'm using: index=some_index | regex NAME="(values|that|are|needed)" | regex LV = "(errors|warning|critical)" | collect index="saved_results"

It will then notify that it's saved to the stash file. How can I run a search on the stash?

[gkanapathy]

let me note that your particular query is probably best improved not by using summary indexing, but instead by using the Splunk index:

index=some_index (NAME=values OR NAME=that OR NAME=are OR NAME=needed) (LV=errors OR LV=warning OR LV=critical)

or

index=some_index (NAME=*values* OR NAME=*that* OR NAME=*are* OR NAME=*needed*) (LV=errors OR LV=warning OR LV=critical)

or whatever is appropriate.

This should run considerably faster than your initial query and is far less complicated than generating a summary.

[gkanapathy]

A summary is really only going to help with post-processing, not retrieval, i.e., if you're doing stats, chart or timechart on results.

[williamsweat]

Ah, thanks for the tips. It was for a fairly lengthy saved query (about 4800 chars) with a lot of NOT and OR's. I was testing to see if creating a summary index would help with performance.

[Ron_Naken · Accepted solution]

The data you pipe to the collect command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:

index=saved_results

[Ron_Naken]

Note: You will need to create the respective index, prior to running the collect command.