Splunk Search

How to read job inspector

yuwtennis
Communicator

Hi!

I have a search job that it's run duration costs about 2100sec.

According to the inspector, I have realized that most of the process of the job is taken by this part.

1,655.963 dispatch.evaluate 1 - -
1,655.899 dispatch.evaluate.join 6

What does this dispatch evaluate stands for??

Thanks,
Yu

Tags (2)
0 Karma
1 Solution

sciurus
Path Finder

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

Specifically, dispatch.evaluate:
The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<command_name> tells you the time spent parsing and evaluating the <command_name> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

View solution in original post

sciurus
Path Finder

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

Specifically, dispatch.evaluate:
The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<command_name> tells you the time spent parsing and evaluating the <command_name> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

yuwtennis
Communicator

Hello martin.

Thanks for the reply.
Understood.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could optimize your search, pre-process parts and store in a summary, use report acceleration if applicable, or just schedule the search if displayed in a dashboard.

However, there is no "make Splunk go ten times as fast" configuration that you can turn on 🙂

0 Karma

yuwtennis
Communicator

Hello sciurus.

Thank you for the reply.

Hmm. I see.
This search is being executed via saved search. (Splunk ver 5.0.5)

Do you know any configuration that can save "evaluation time" ,perhaps, caching this search command?

Thanks,
Yu

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...