Splunk Search

How can I measure the search run time until the first result is returned?

zuckermanori
Engager

I'm benchmarking performance of search queries.

I noticed that although the entire search pipeline takes long to complete, initial results are returned quickly.

how can I measure the query run time until the first result is returned?

currently i'm measuring the entire query run time with 

 

 

history.total_run_time

 

 

but that gives me the total time and I want the time for first result.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

zuckermanori
Engager

thans @gcusello it works, just need to change 

head=1

to 

head 1

please modify your answer and i'll accept it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori,

sorry, you're right!

Thank you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...