Splunk Search

How can I measure the search run time until the first result is returned?

zuckermanori
Engager

I'm benchmarking performance of search queries.

I noticed that although the entire search pipeline takes long to complete, initial results are returned quickly.

how can I measure the query run time until the first result is returned?

currently i'm measuring the entire query run time with 

 

 

history.total_run_time

 

 

but that gives me the total time and I want the time for first result.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

zuckermanori
Engager

thans @gcusello it works, just need to change 

head=1

to 

head 1

please modify your answer and i'll accept it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori,

sorry, you're right!

Thank you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...