How to enable search for specific index?

[Raymond2T]

I decided to make a search with following situation. 

However, I would like to enhance the performance that when user wanna search Name, it will only enable index A and B  but not index C

Can I achieve it?

Thanks a lot.

|multisearch

[ index =A |search Name=* Results =*]

[index =B | search Name=* Age=* Results=*]

[index =C | search Name=* Age=*]

[PickleRick]

Please be a bit more specific about the context. Are you trying to make a search which will be embedded in a dashboard? Or is it just a template you can give to your users to use?

Anyway, in your case you don't need a multisearch. The exactly same results can be achieved by using just a single search with a logical alternative of your conditions:

( index=A Name=* Results=*) OR (index=B Name=* Age=* Results=*) OR ( index=C Name=* Age=*)

But I suppose there is something more to this question that meets the eye

[Raymond2T]

because it consists of more than 10GB data.

It may takes time to finish a search.

therefore I think multisearch could be better solution.

On the other hand, could I integrate splunk enterprise with GPU to enhance searching performance?

[PickleRick]

This kind of search (a so-called "dense search") will be limited by I/O performance anyway. But another question is why would you want to return such a huge set of events? Splunk's core ability is to search for events, filter them and transform/summarize to efficiently get your "final answer". Searching for a huge set of data and processing that set further in another solution is rarely the result you want.

What is your business need? Noone will be reading through several gigabytes of events manually.

[Raymond2T]

actually i do not want to return huge amount of data, i just want to search from 10Gb data to get my results and process it.

But it really really really takes time to complete a search.

[PickleRick]

Your initial search (regardless of whether in "your" form or "mine") would return all the events which had any of the given fields defined so they would return huge amounts of data probably.

And even if those fields were defined in only a smal subset of events, it would also take splunk a lot of time to find that out because you haven't given "static" terms to look for. Remember that most of splunk operations happen in search time so splunk doesn't know that something is - let's say - a field called Username unless it checks, during search-time, that this part of event fits the definition (usually a regex) of that field.

So if you have 10GB worth of data and only 1MB of them contains the field called Username, splunk still has to parse all 10GB to find whether any single event contains something that matches the definition of Username field.

If, however, you search for - for example - Username=some_username it works completely "backwards". Firstly splunk searches for all events that do contain the string some_username (and is able to do so quite efficiently - that's what indexes are for), finds out that - for example - 2MBs of your data contain this string and only has to look through these 2MBs of data to find out in which of those events some_username value is in the proper place in the event so that it is the field Username.

But if you want to do some general statistics over all of your data or stuff like that, there's no way around the fact that splunk has to read from the disk and interpret a huge amount of data. (that's where some special techiques of accelerating searches come into play but that's more advanced topic).

That's why you need to think what you want to get from your data and how to get it efficiently. Especially that with distributed environment (many indexers) with properly written search you can offload significant part of your work to indexers so that each of them does its small part thus making the whole search job much quicker.

[gcusello]

Hi @Raymond2T,

let me understand: you want to search in three indexes, using the Name field in all of them  and the Age field only in index B and C?

is it correct? or what else

you have to use boolean operators and parenthesis in the main search to group the conditions:

index=A OR (index=B Age=*) OR (index=C Age=*) Name=*
| ...

Then, put the search conditions as left as possible, in other words, use the search command only if mandatory, in this way you'll have more performant searches.

Ciao.

Giuseppe

[Raymond2T]

because it consists of more than 10GB data.

It may takes time to finish a search.

therefore I think multisearch could be better solution.

• On the other hand, could I integrate splunk enterprise with GPU to enhance searching performance?