How to read job inspector

[yuwtennis]

Hi!

I have a search job that it's run duration costs about 2100sec.

According to the inspector, I have realized that most of the process of the job is taken by this part.

1,655.963 dispatch.evaluate 1 - -
1,655.899 dispatch.evaluate.join 6

What does this dispatch evaluate stands for??

Thanks,
Yu

[sciurus · Accepted solution]

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

Specifically, dispatch.evaluate:
The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<command_name> tells you the time spent parsing and evaluating the <command_name> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

[yuwtennis]

Hello martin.

Thanks for the reply.
Understood.

[martin_mueller]

You could optimize your search, pre-process parts and store in a summary, use report acceleration if applicable, or just schedule the search if displayed in a dashboard.

However, there is no "make Splunk go ten times as fast" configuration that you can turn on 🙂

[yuwtennis]

Hello sciurus.

Thank you for the reply.

Hmm. I see.
This search is being executed via saved search. (Splunk ver 5.0.5)

Do you know any configuration that can save "evaluation time" ,perhaps, caching this search command?

Thanks,
Yu