Splunk Search

How to optimize the given query without using join

avni26
Explorer

Hi,

I need to Optimize my query to improve the dashboard performance without using any type of join function.

Below is my query
| inputlookup sample.csv

| search user IN ( ) application_name IN () "application id" IN (*)
|eval None="None"
| table "application id",application_name,user,"Status",Type,"Service Host",Platform,Jan,Feb,Mar,Apr,None,env
| rename "application_name" as Server_Name
| eval Server_Name=upper(Server_Name)
| join type=left Server_Name
[ search index=idx sourcetype=xyz
| eval Server_Name=upper(Server_Name)
| search Status!="Completed"
| table Server_Name Status]
| search Status!="Completed" | stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env
| eval total = jan+feb + mar + apr
|table env total

Please help me to optimize this query without using join

Tags (1)
0 Karma

to4kawa
Ultra Champion

UPDATED:

index=idx sourcetype=xyz Status="retain" OR Status="progress"  Server_Name=*
| eval Server_Name=upper(Server_Name) 
| table Server_Name Status
| dedup Server_Name
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 
| eval None="None" 
| where isnotnull(user) 
| search user IN ( ) application_name IN () "application id" IN (*) 
| stats sum("Jan") as jan sum("Feb") as feb sum("Mar") as mar sum("Apr") as apr by env 
| eval total = jan+feb + mar + apr 
| table env total

Hi, @avni26
some code is disappear.Status of Server_Name is latest status.

0 Karma

avni26
Explorer

@to4kawa Thank you for your response.
I tried to execute like above, but why lookup fields giving multiple values in same row.

thanks,

0 Karma

to4kawa
Ultra Champion
| lookup sample.csv "application_name" as Server_Name OUTPUTNEW 

Maybe, there is same Server_name.

| dedup Server_name
but, Status is unclear.

0 Karma

avni26
Explorer

Status is coming from index having values like completed, retain, progress l

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...