Splunk Search

How to optimize the given query without using join

avni26
Explorer

Hi,

I need to Optimize my query to improve the dashboard performance without using any type of join function.

Below is my query
| inputlookup sample.csv

| search user IN ( ) application_name IN () "application id" IN (*)
|eval None="None"
| table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env
| rename "application_name" as Server_Name
| eval Server_Name=upper(Server_Name)
| join type=left Server_Name
[ search index=idx sourcetype=xyz
| eval Server_Name=upper(Server_Name)
| search Status!="Completed"
| table Server_Name Status]
| search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
|table env total

Please help me to optimize this query without using join

Tags (1)
0 Karma

to4kawa
Ultra Champion

UPDATED:

index=idx sourcetype=xyz Status="retain" OR Status="progress"  Server_Name=*
| eval Server_Name=upper(Server_Name) 
| table Server_Name Status
| dedup Server_Name
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 
| eval None="None" 
| where isnotnull(user) 
| search user IN ( ) application_name IN () "application id" IN (*) 
| stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env 
| eval total = jan+feb + mar + apr 
| table env total

Hi, @avni26
some code is disappear.Status of Server_Name is latest status.

0 Karma

avni26
Explorer

@to4kawa Thank you for your response.
I tried to execute like above, but why lookup fields giving multiple values in same row.

thanks,

0 Karma

to4kawa
Ultra Champion
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 

Maybe, there is same Server_name.

| dedup Server_name
but, Status is unclear.

0 Karma

avni26
Explorer

Status is coming from index having values like completed, retain, progress l

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...