Improving Search Speed in Stats Query - Splunk Community

Splunk Search

I'd like to run search to look at average and max values for every server over an extended period of time. Currently I'm doing

index=os sourcetype="sourcetype" source="source"|stats avg(Value) max(Value) by host

But this is taking an extremely long time to run. Is there a way to make this search more efficient?

Are you running a separate search for each process? If so, you could build a simple if statement to specify the value like this

index=os
| eval CPU=if(counter="% Processor Time",'Value',"N/A")
| eval Disk=if(counter="% Free Space",'Value',"N/A")

If not then you may want to look into accelerated data models. This will run substantially faster than over the raw data

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratedatamodels

Get Updates on the Splunk Community!

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Data Drivers: Every Lap Tells a Story The Spectacle Two F1 racing sims go head-to-head on the .conf26 show ...