Splunk Search

How to optimize the given query without using join

avni26
Explorer

Hi,

I need to Optimize my query to improve the dashboard performance without using any type of join function.

Below is my query
| inputlookup sample.csv

| search user IN ( ) application_name IN () "application id" IN (*)
|eval None="None"
| table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env
| rename "application_name" as Server_Name
| eval Server_Name=upper(Server_Name)
| join type=left Server_Name
[ search index=idx sourcetype=xyz
| eval Server_Name=upper(Server_Name)
| search Status!="Completed"
| table Server_Name Status]
| search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
|table env total

Please help me to optimize this query without using join

Tags (1)
0 Karma

to4kawa
Ultra Champion

UPDATED:

index=idx sourcetype=xyz Status="retain" OR Status="progress"  Server_Name=*
| eval Server_Name=upper(Server_Name) 
| table Server_Name Status
| dedup Server_Name
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 
| eval None="None" 
| where isnotnull(user) 
| search user IN ( ) application_name IN () "application id" IN (*) 
| stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env 
| eval total = jan+feb + mar + apr 
| table env total

Hi, @avni26
some code is disappear.Status of Server_Name is latest status.

0 Karma

avni26
Explorer

@to4kawa Thank you for your response.
I tried to execute like above, but why lookup fields giving multiple values in same row.

thanks,

0 Karma

to4kawa
Ultra Champion
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 

Maybe, there is same Server_name.

| dedup Server_name
but, Status is unclear.

0 Karma

avni26
Explorer

Status is coming from index having values like completed, retain, progress l

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Let's say I've just rolled out a Kubernetes Deployment with a typo in the image tag. Nothing explodes. The pod ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...