Splunk Search

How to make the search time faster when including a timechart of total servers (Windows and NIX) in a leadership dashboard?

gabarrygowin
Path Finder

Hi everyone,

Would appreciate your input on a challenge. For our leadership's dashboard we've been asked to include a timechart of total servers (Windows and NIX).

My current search is just taking too long (7 hours). I can cron it for 5:30am and populate the dashboard. They don't need to the minute data, but data would be nice period.

"(index=unix OR index=windows) (sourcetype=WinEventLog* OR source=/var/log/*)  (host!=*.ga.com) earliest=-5w@w latest=now 
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1Mon
| delta "Total Servers" "
1 Solution

somesoni2
Revered Legend

I would use tstats command here since your base search uses only the metadata fields (host/source/sourcetype/index-time created fields).

| tstats count WHERE (index=unix OR index=windows) (sourcetype="WinEventLog*" OR source="/var/log/*")  (host!="*.ga.com") earliest=-5w@w latest=now by _time host span=1mon
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1mon
| delta "Total Servers" 

View solution in original post

somesoni2
Revered Legend

I would use tstats command here since your base search uses only the metadata fields (host/source/sourcetype/index-time created fields).

| tstats count WHERE (index=unix OR index=windows) (sourcetype="WinEventLog*" OR source="/var/log/*")  (host!="*.ga.com") earliest=-5w@w latest=now by _time host span=1mon
| eval host=upper(host)
| timechart dc(host) AS "Total Servers" span=1mon
| delta "Total Servers" 

gabarrygowin
Path Finder

Somesoni2 Rocks!! (as usual).

The tstats finished in 16.6 minutes (from 7 hours). This was across 84 Billion events!!

0 Karma
Get Updates on the Splunk Community!

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...