Splunk Search

Is it possible to specify Event Sampling in a query for use in a Dashboard?

dmoberg
Path Finder

For the type of data I am trying to extract, Event Sampling really speeds up the query. This works fine when executing SPL queries, but I have not been able to figure out how to do this in a dashboard. Found some older posts where "rand" was used, but apparently that did not speed up the query.

 

Is it possible to specify Event Sampling directly in a Search Query or in the Dashboard in some way?

Labels (1)
Tags (1)
0 Karma
1 Solution

FelixLeh
Contributor

I think this Splunk Docs article should help (Event sampling with reports and dashboard panels topic):

https://docs.splunk.com/Documentation/Splunk/latest/Search/Retrieveasamplesetofevents

<event>
  <title>sample events</title>
  <search>
     <query>buttercupgames</query>
     <earliest>@d</earliest>
     <latest>now</latest>
     <sampleRatio>500</sampleRatio>
  </search>
</event>

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Contributor

I think this Splunk Docs article should help (Event sampling with reports and dashboard panels topic):

https://docs.splunk.com/Documentation/Splunk/latest/Search/Retrieveasamplesetofevents

<event>
  <title>sample events</title>
  <search>
     <query>buttercupgames</query>
     <earliest>@d</earliest>
     <latest>now</latest>
     <sampleRatio>500</sampleRatio>
  </search>
</event>

_______________________________________

If this was helpful please consider awarding Karma. Thx!

dmoberg
Path Finder

Thanks. I tried it but it seems when this setting is used in the Dashboard there is no performance improvement at all. Running the exact same query directly in SPL with the same Event Sampling is much quicker.

Maybe this is a bug in the implementation?

 

0 Karma

FelixLeh
Contributor

In my tests when I used sampleRatio 5000 and the search time was reduced from 35 seconds to 4.. so it seems to work fine on my end. Maybe there is something in your search/dashboard that limits the speed regardless of sampling? Reasons could be:

- early transformative command like table or stats command that force Splunk to work on the search head instead of index.

- Great amount of searches/panels on Dashboards spike resource usage and may slow down Splunk


If you want to want to describe the surrounding dashboard or the query that you are using I may be able to help. 

_______________________________________

If this was helpful please consider awarding Karma. Thx!

dmoberg
Path Finder

Problem solved. I had the Dashboard pane search settings for the Time Picker set to Global, instead of Shared Time Picker. BUT, I earlier checked the Source of the Dashboard and the Earliest was set to "-24h" and still the search took forever, but directly in Splunk search the same search for 24 hrs was really quick. Maybe when Global is selected as the Time Picker, the Earliest setting is ignored and instead All Time is selected (picked up from elsewhere)?

 

Anyways, thanks allot now it works great!!

0 Karma

FelixLeh
Contributor

Glad I was able to help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...