How to make search faster

[kteng2024]

Hello,

below is my search . Since i am using join , search is slow . Can i please know if there is a way to increase the speed of the search rather than absolutely specifying the index.

| tstats max(time) as lastReport WHERE splunk_server_group=abc index=*_abc* OR index=main by host | eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") | table LastReported host |join host [search index=_internal hostname=* | stats count by hostname sourceIp| rename hostname as host ]

[kamlesh_vaghela]

Hi @kteng2024

Can you please try this?

| tstats max(_time) as lastReport WHERE splunk_server_group=abc index=abc OR index=main by host 
| eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") 
| fields LastReported host 
| append 
    [ search index=_internal hostname=* 
    | stats count by hostname sourceIp 
    | rename hostname as host ] | stats values(sourceIp) as sourceIp values(LastReported) as LastReported by host

[Elsurion]

A short win is when you add

| fields hostname, sourceIp

to your search, on my system it gave me about a win of 50% searchtime from 22sec to 11sec over a period of 60mins

Other question is, what are you expecting from your search here? Just a list when a certain host has sent last it's data?

[mayurr98]

Have you tried doing report acceleration?