How to accelerate the time is takes request to generate result?

[chimell1]

Hi!

My request take much time to generate the result, how can i accelerate it

| mpreview index=ciusss_vitals_linux_metric
| stats latest(_time) as latest1 by host
| eval recent = if(latest1 > relative_time(now(),"-5m"),1,0), realLatest = strftime(latest1,"%c")
| search recent=0
| stats values(host) as host
| mvexpand host | map search="| ping host=$host$" maxsearches=200

[yeahnah]

Hi @chimell1 

Using map (basically a loop) can be inherently slow if it needs to do lots of iterations.  Currently it could do up to 200 separate searches to complete the result set for you.

The "| ping " command is also a non standard Splunk command.  Is that from a custom command or from a third party app?  If the ping command is slow to return a result when it's run then you're limited by its speed too.