How to make the search time faster when including a timechart of total servers (Windows and NIX) in a leadership dashboard?

[gabarrygowin]

Hi everyone,

Would appreciate your input on a challenge. For our leadership's dashboard we've been asked to include a timechart of total servers (Windows and NIX).

My current search is just taking too long (7 hours). I can cron it for 5:30am and populate the dashboard. They don't need to the minute data, but data would be nice period.

"(index=unix OR index=windows) (sourcetype=WinEventLog* OR source=/var/log/*)  (host!=*.ga.com) earliest=-5w@w latest=now 
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1Mon
| delta "Total Servers" "

[somesoni2 · Accepted solution]

I would use tstats command here since your base search uses only the metadata fields (host/source/sourcetype/index-time created fields).

| tstats count WHERE (index=unix OR index=windows) (sourcetype="WinEventLog*" OR source="/var/log/*")  (host!="*.ga.com") earliest=-5w@w latest=now by _time host span=1mon
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1mon
| delta "Total Servers" 

[gabarrygowin]

Somesoni2 Rocks!! (as usual).

The tstats finished in 16.6 minutes (from 7 hours). This was across 84 Billion events!!