Splunk Search

How to optimize the given query without using join

avni26
Explorer

Hi,

I need to Optimize my query to improve the dashboard performance without using any type of join function.

Below is my query
| inputlookup sample.csv

| search user IN ( ) application_name IN () "application id" IN (*)
|eval None="None"
| table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env
| rename "application_name" as Server_Name
| eval Server_Name=upper(Server_Name)
| join type=left Server_Name
[ search index=idx sourcetype=xyz
| eval Server_Name=upper(Server_Name)
| search Status!="Completed"
| table Server_Name Status]
| search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
|table env total

Please help me to optimize this query without using join

Tags (1)
0 Karma

to4kawa
Ultra Champion

UPDATED:

index=idx sourcetype=xyz Status="retain" OR Status="progress"  Server_Name=*
| eval Server_Name=upper(Server_Name) 
| table Server_Name Status
| dedup Server_Name
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 
| eval None="None" 
| where isnotnull(user) 
| search user IN ( ) application_name IN () "application id" IN (*) 
| stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env 
| eval total = jan+feb + mar + apr 
| table env total

Hi, @avni26
some code is disappear.Status of Server_Name is latest status.

0 Karma

avni26
Explorer

@to4kawa Thank you for your response.
I tried to execute like above, but why lookup fields giving multiple values in same row.

thanks,

0 Karma

to4kawa
Ultra Champion
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 

Maybe, there is same Server_name.

| dedup Server_name
but, Status is unclear.

0 Karma

avni26
Explorer

Status is coming from index having values like completed, retain, progress l

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...