Splunk Search

Is it possible to specify Event Sampling in a query for use in a Dashboard?

dmoberg
Explorer

For the type of data I am trying to extract, Event Sampling really speeds up the query. This works fine when executing SPL queries, but I have not been able to figure out how to do this in a dashboard. Found some older posts where "rand" was used, but apparently that did not speed up the query.

 

Is it possible to specify Event Sampling directly in a Search Query or in the Dashboard in some way?

Labels (1)
Tags (1)
0 Karma
1 Solution

FelixLeh
Communicator

I think this Splunk Docs article should help (Event sampling with reports and dashboard panels topic):

https://docs.splunk.com/Documentation/Splunk/latest/Search/Retrieveasamplesetofevents

<event>
  <title>sample events</title>
  <search>
     <query>buttercupgames</query>
     <earliest>@d</earliest>
     <latest>now</latest>
     <sampleRatio>500</sampleRatio>
  </search>
</event>

_______________________________________

If this was helpful please consider awarding Karma. Thx!

View solution in original post

FelixLeh
Communicator

I think this Splunk Docs article should help (Event sampling with reports and dashboard panels topic):

https://docs.splunk.com/Documentation/Splunk/latest/Search/Retrieveasamplesetofevents

<event>
  <title>sample events</title>
  <search>
     <query>buttercupgames</query>
     <earliest>@d</earliest>
     <latest>now</latest>
     <sampleRatio>500</sampleRatio>
  </search>
</event>

_______________________________________

If this was helpful please consider awarding Karma. Thx!

dmoberg
Explorer

Thanks. I tried it but it seems when this setting is used in the Dashboard there is no performance improvement at all. Running the exact same query directly in SPL with the same Event Sampling is much quicker.

Maybe this is a bug in the implementation?

 

0 Karma

FelixLeh
Communicator

In my tests when I used sampleRatio 5000 and the search time was reduced from 35 seconds to 4.. so it seems to work fine on my end. Maybe there is something in your search/dashboard that limits the speed regardless of sampling? Reasons could be:

- early transformative command like table or stats command that force Splunk to work on the search head instead of index.

- Great amount of searches/panels on Dashboards spike resource usage and may slow down Splunk


If you want to want to describe the surrounding dashboard or the query that you are using I may be able to help. 

_______________________________________

If this was helpful please consider awarding Karma. Thx!

dmoberg
Explorer

Problem solved. I had the Dashboard pane search settings for the Time Picker set to Global, instead of Shared Time Picker. BUT, I earlier checked the Source of the Dashboard and the Earliest was set to "-24h" and still the search took forever, but directly in Splunk search the same search for 24 hrs was really quick. Maybe when Global is selected as the Time Picker, the Earliest setting is ignored and instead All Time is selected (picked up from elsewhere)?

 

Anyways, thanks allot now it works great!!

0 Karma

FelixLeh
Communicator

Glad I was able to help!

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...