Splunk Search

How can I measure the search run time until the first result is returned?

zuckermanori
Engager

I'm benchmarking performance of search queries.

I noticed that although the entire search pipeline takes long to complete, initial results are returned quickly.

how can I measure the query run time until the first result is returned?

currently i'm measuring the entire query run time with 

 

 

history.total_run_time

 

 

but that gives me the total time and I want the time for first result.

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

zuckermanori
Engager

thans @gcusello it works, just need to change 

head=1

to 

head 1

please modify your answer and i'll accept it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori,

sorry, you're right!

Thank you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...