How do I optimize the performance of this search with appendcols?

[vranjith009]

Hi ,

Can any one help with fine tuning this search? It's taking a long time to load.

index=me sourcetype=access_apache | stats avg(responsemili) as "Avg Response" |eval "Avg Response"=round('Avg Response',2) | appendcols maxtime=600 [ search index=me sourcetype=access_apache NOT clientip = 172.* NOT clientip = 10.* | stats avg(responsemili) as "Avg Response(Internet)" | eval "Avg Response(Internet)"=round('Avg Response(Internet)',2)] | appendcols maxtime=600 [ search index=me sourcetype=access_apache clientip = 172.* OR clientip = 10.* | stats avg(responsemili) as "Avg Response(Intranet)"|eval "Avg Response(Intranet)"=round('Avg Response(Intranet)',2)]

[sundareshr]

See if this works

 index=me sourcetype=access_apache | eval inter=if((clientip!=172. AND clientip != 10.), responsemili, "")  | eval intra=if((clientip=172. AND clientip = 10.),responsemili, "") | stats avg(responsemili) as "Avg Response" avg(inter) as "Avg Response(Internet)",  avg(intra) as "Avg Response(Intranet)"

[renjith_nair]

I would use stats with eval instead of appendcols, something like below. You will have to adjust the conditions and syntax inside if or use match but the skeleton should be something similar

index=me sourcetype=access_apache 
|stats avg(eval(if(clientip != 172. AND clientip != 10.),responsemili)) as Avg Response(Internet)",
avg(eval(if(clientip = 172. OR clientip = 10.),responsemili)) as Avg Response(Intranet)",
avg(responsemili) as "Avg Response"

Reference : http://docs.splunk.com/Documentation/Splunk/6.1/Search/Usestatswithevalexpressionsandfunctions

[renjith_nair]

let me know if it helps

[vranjith009]

Its not renjith.

I hope "stats avg(eval(if(clientip != 172. AND clientip != 10.),responsemili))" NOT function is not taking with eval