Splunk Search

How can I resuse the output of a query to compute larger timeframes?

yk010123
Path Finder

I am currently running a query that is quite inefficient, and it fails when run for extended periods.

Splunk only allows me to run it every 15 minutes, which is a limitation I have as a work around for now.

Unfortunately, I can't improve the situation because I don't have control over the log creation process as the logs come from a third party system

Currently, I'm running the query as an alert every 15 minutes, but I'd like to capture these metrics over a more extended period, such as 24 hours or more.

Is there a built-in mechanism in Splunk that can store and append the results of these queries for future reference?

I am aware that I could use the Java SDK to extract and aggregate the metrics outside of Splunk, but that approach is not ideal.

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...