Splunk Search

Help with collect and searching stash files

williamsweat
Path Finder

Hello,

I'm trying to use collect and the subsequent stash file to save time on a large search query. The documentation on collect, http://www.splunk.com/base/Documentation/4.2/SearchReference/Collect, doesn't mention how to then use the stash file.

For example, this is the search query I'm using: index=some_index | regex NAME="(values|that|are|needed)" | regex LV = "(errors|warning|critical)" | collect index="saved_results"

It will then notify that it's saved to the stash file. How can I run a search on the stash?

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

The data you pipe to the collect command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:

index=saved_results

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

let me note that your particular query is probably best improved not by using summary indexing, but instead by using the Splunk index:

index=some_index (NAME=values OR NAME=that OR NAME=are OR NAME=needed) (LV=errors OR LV=warning OR LV=critical)

or

index=some_index (NAME=*values* OR NAME=*that* OR NAME=*are* OR NAME=*needed*) (LV=errors OR LV=warning OR LV=critical)

or whatever is appropriate.

This should run considerably faster than your initial query and is far less complicated than generating a summary.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

A summary is really only going to help with post-processing, not retrieval, i.e., if you're doing stats, chart or timechart on results.

0 Karma

williamsweat
Path Finder

Ah, thanks for the tips. It was for a fairly lengthy saved query (about 4800 chars) with a lot of NOT and OR's. I was testing to see if creating a summary index would help with performance.

0 Karma

Ron_Naken
Splunk Employee
Splunk Employee

The data you pipe to the collect command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:

index=saved_results

Ron_Naken
Splunk Employee
Splunk Employee

Note: You will need to create the respective index, prior to running the collect command.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...