Hello,
below is my search . Since i am using join , search is slow . Can i please know if there is a way to increase the speed of the search rather than absolutely specifying the index.
| tstats max(time) as lastReport WHERE splunk_server_group=abc index=*_abc* OR index=main by host | eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") | table LastReported host |join host [search index=_internal hostname=* | stats count by hostname sourceIp| rename hostname as host ]
Hi @kteng2024
Can you please try this?
| tstats max(_time) as lastReport WHERE splunk_server_group=abc index=abc OR index=main by host
| eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S")
| fields LastReported host
| append
[ search index=_internal hostname=*
| stats count by hostname sourceIp
| rename hostname as host ] | stats values(sourceIp) as sourceIp values(LastReported) as LastReported by host
A short win is when you add
| fields hostname, sourceIp
to your search, on my system it gave me about a win of 50% searchtime from 22sec to 11sec over a period of 60mins
Other question is, what are you expecting from your search here? Just a list when a certain host has sent last it's data?
Have you tried doing report acceleration?