Splunk Search

How do I optimize the performance of this search with appendcols?

vranjith009
New Member

Hi ,

Can any one help with fine tuning this search? It's taking a long time to load.

index=me sourcetype=access_apache | stats avg(responsemili) as "Avg Response" |eval "Avg Response"=round('Avg Response',2) | appendcols maxtime=600 [ search index=me sourcetype=access_apache NOT clientip = 172.* NOT clientip = 10.* | stats avg(responsemili) as "Avg Response(Internet)" | eval "Avg Response(Internet)"=round('Avg Response(Internet)',2)] | appendcols maxtime=600 [ search index=me sourcetype=access_apache clientip = 172.* OR clientip = 10.* | stats avg(responsemili) as "Avg Response(Intranet)"|eval "Avg Response(Intranet)"=round('Avg Response(Intranet)',2)]
0 Karma

sundareshr
Legend

See if this works

 index=me sourcetype=access_apache | eval inter=if((clientip!=172. AND clientip != 10.), responsemili, "")  | eval intra=if((clientip=172. AND clientip = 10.),responsemili, "") | stats avg(responsemili) as "Avg Response" avg(inter) as "Avg Response(Internet)",  avg(intra) as "Avg Response(Intranet)"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

I would use stats with eval instead of appendcols, something like below. You will have to adjust the conditions and syntax inside if or use match but the skeleton should be something similar

index=me sourcetype=access_apache 
|stats avg(eval(if(clientip != 172. AND clientip != 10.),responsemili)) as Avg Response(Internet)",
avg(eval(if(clientip = 172. OR clientip = 10.),responsemili)) as Avg Response(Intranet)",
avg(responsemili) as "Avg Response"

Reference : http://docs.splunk.com/Documentation/Splunk/6.1/Search/Usestatswithevalexpressionsandfunctions

Happy Splunking!

renjith_nair
SplunkTrust
SplunkTrust

let me know if it helps

Happy Splunking!
0 Karma

vranjith009
New Member

Its not renjith.

I hope "stats avg(eval(if(clientip != 172. AND clientip != 10.),responsemili))" NOT function is not taking with eval

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...