Splunk Search

Make search faster

tgdvopab
Path Finder

Hello

I have the following search:

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1" |  timechart avg(Value) as Value by host |  appendcols  [search index=test  sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold | search id="1"  |  bucket _time span=5min |  timechart values(threshold) as "threshold"]

The problem is, that the search takes too much time.
Is there a way to make the search faster?

Thanks 🙂

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

tgdvopab
Path Finder

Thanks a lot for your solution! The search ist very fast now.
Could you explain me, what "appendpipe" and at the end "table" does?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Since, your first query aggregates based on host and time but second query does only by time, the query before appendpipe is doing summary of both value and threshold (I assume threshold is constant for a host) and appendpipe generate a summary just of time (no host). The eval inside appendpipe subsearch ensure threshold be added as host so that a column/series can be generated by the subsequent timechart.

The last table just does the column ordering _time, "all hosts", threshold

0 Karma

JMichaelis
Path Finder

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...