Splunk Search

How to sample first N minutes of span in timechart, with huge numbers of events?

rpecka
Explorer

I would like to run a timechart query that ends with `| timechart span=1h distinct_count(thing) by other_thing`

The problem is that there are a huge number of events being counted so the query takes a long time. Is there a way that I can run the same query but sample only the first 5 minutes of every hour so that I can speed up the query?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rpecka,

you can use one of the answers of @bowesmana that are all correct or try adding:

time_minutes<6

to your main search.

Ciao.

Giuseppe

bowesmana
SplunkTrust
SplunkTrust

There are also a number of other possibilities to optimise a slow running query.

1. Check that the query is written efficiently. If you want to post your full query, some here may be able to suggest improvements

2. Run a regular saved search that collects the dc() every hour to a summary index and then use that data to report here

3. Run the search as a saved search and use that previously run search for your results.

4. If you really want the first 5 minutes, as opposed to sampling, you could then make a search that does this

search bla bla bla ((earliest=-4h@h latest=-4h@h+5m) OR 
                    (earliest=-3h@h latest=-3h@h+5m) OR 
                    (earliest=-2h@h latest=-2h@h+5m) OR 
                    (earliest=-h@h latest=-h@h+5m) OR
                    (earliest=@h latest=h+5m))

depending on whatever timerange you are including.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If this is in the search UI, you can set the Sampling ratio in the Event Sampling dropdown

bowesmana_0-1660623179839.png

Alternatively, if this is in a dashboard, set the sampleRatio XML element of the search

 

<search>
  <query>
  ... 
  </query>
  <sampleRatio>1</sampleRatio>
</search>

 

See the description here

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Viz/PanelreferenceforSimplifiedXML#search

 

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...