Improving Search Speed in Stats Query

[TylerJVitale]

I'd like to run search to look at average and max values for every server over an extended period of time. Currently I'm doing

index=os sourcetype="sourcetype" source="source"|stats avg(Value) max(Value) by host

But this is taking an extremely long time to run. Is there a way to make this search more efficient?

[skoelpin]

Are you running a separate search for each process? If so, you could build a simple if statement to specify the value like this

index=os
| eval CPU=if(counter="% Processor Time",'Value',"N/A")
| eval Disk=if(counter="% Free Space",'Value',"N/A")

If not then you may want to look into accelerated data models. This will run substantially faster than over the raw data

http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Acceleratedatamodels