How to improve efficiency of a Splunk search?

[nilbak88]

Hi All,

One of my scheduled report is quite expensive.
It runs everyday from Monday to Friday and results in 30 days worth of data.

Search Query
index=abc_* | stats count by index,host

How can I improve its search efficiency?
Please suggest .

[ITWhisperer]

You could put your daily counts into a summary index, then create a report which sums counts from the summary index for the last 30 days

[gcusello]

Hi @nilbak88,

if in your search you have to use only index and host, you can use | metasearch for faster searches:

| metasearch index=abc_* 
| stats count by index host

for more infos see at https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Metasearch

Ciao.

Giuseppe

[nilbak88]

Thanks @gcusello 

That was really quick and helpful.
Also, is there is any possibility if we can modify time range setting in such a way that is do not overlap the data.

Like currently, its running everyday and resulting 30 days of data since time range is set as of 30 days.

[gcusello]

Hi @nilbak88 ,

if you want to fix the time range e.g. from the last 30 days to the end of yestarday, you could add some time modifiers like this:

| metasearch index=abc_* earliest=-30d@d latest=@d
| stats count by index host

Ciao.

Giuseppe