Make search faster

[tgdvopab]

Hello

I have the following search:

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1" |  timechart avg(Value) as Value by host |  appendcols  [search index=test  sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold | search id="1"  |  bucket _time span=5min |  timechart values(threshold) as "threshold"]

The problem is, that the search takes too much time.
Is there a way to make the search faster?

Thanks 🙂

[somesoni2 · Accepted solution]

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

[tgdvopab]

Thanks a lot for your solution! The search ist very fast now.
Could you explain me, what "appendpipe" and at the end "table" does?

[somesoni2]

Since, your first query aggregates based on host and time but second query does only by time, the query before appendpipe is doing summary of both value and threshold (I assume threshold is constant for a host) and appendpipe generate a summary just of time (no host). The eval inside appendpipe subsearch ensure threshold be added as host so that a column/series can be generated by the subsequent timechart.

The last table just does the column ordering _time, "all hosts", threshold

[JMichaelis]

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up.