Splunk Search

How can I measure the search run time until the first result is returned?

zuckermanori
Engager

I'm benchmarking performance of search queries.

I noticed that although the entire search pipeline takes long to complete, initial results are returned quickly.

how can I measure the query run time until the first result is returned?

currently i'm measuring the entire query run time with 

 

 

history.total_run_time

 

 

but that gives me the total time and I want the time for first result.

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori.

add "| head 1" to your search

Ciao.

Giuseppe

zuckermanori
Engager

thans @gcusello it works, just need to change 

head=1

to 

head 1

please modify your answer and i'll accept it

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zuckermanori,

sorry, you're right!

Thank you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...