Splunk Search

How do I optimize the performance of my search that is currently using a different time range per sourcetype?

McJansen
Engager

Hi,

I have a performance issue concerning multiple time ranges in 1 search.
The search string is as follows:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 hoursago=24])

I choose for the timerangepicker the value: last 3 months.

Now this search will take ages.
The first part of the search isn't the problem, but the second one is.
It should be clear that I want all records from the first part and only the records from the last 24 hours from the last part.
The search above provide me with these, but the search takes ages.

My question is: isn't there a way to make this search faster?
I can't join because of the number of records (over 72 million) .

Thanx in advance!!

0 Karma
1 Solution

NOUMSSI
Builder

Hi,

Try this for your the second one:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])

View solution in original post

0 Karma

NOUMSSI
Builder

Hi,

Try this for your the second one:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])

View solution in original post

0 Karma

McJansen
Engager

Sometimes I feel stupid! 😉

Thanx!!!!

0 Karma

NOUMSSI
Builder

Ok! please dont forget to vote me

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.