Splunk Search

How to read job inspector

Communicator

Hi!

I have a search job that it's run duration costs about 2100sec.

According to the inspector, I have realized that most of the process of the job is taken by this part.

1,655.963 dispatch.evaluate 1 - -
1,655.899 dispatch.evaluate.join 6

What does this dispatch evaluate stands for??

Thanks,
Yu

Tags (2)
0 Karma
1 Solution

Path Finder

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

Specifically, dispatch.evaluate:
The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<commandname> tells you the time spent parsing and evaluating the <commandname> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

View solution in original post

Path Finder

See this link: http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

Specifically, dispatch.evaluate:
The time spent parsing the search and setting up the data structures needed to run the search. This component also includes the time it takes to evaluate and run subsearches. This is broken down further for each search command that is used. In general, dispatch.evaluate.<commandname> tells you the time spent parsing and evaluating the <commandname> argument. For example, dispatch.evaluate.search indicates the time spent evaluating and parsing the search command argument.

View solution in original post

Communicator

Hello martin.

Thanks for the reply.
Understood.

0 Karma

SplunkTrust
SplunkTrust

You could optimize your search, pre-process parts and store in a summary, use report acceleration if applicable, or just schedule the search if displayed in a dashboard.

However, there is no "make Splunk go ten times as fast" configuration that you can turn on 🙂

0 Karma

Communicator

Hello sciurus.

Thank you for the reply.

Hmm. I see.
This search is being executed via saved search. (Splunk ver 5.0.5)

Do you know any configuration that can save "evaluation time" ,perhaps, caching this search command?

Thanks,
Yu

0 Karma