Splunk Search

Make search faster

tgdvopab
Path Finder

Hello

I have the following search:

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1" |  timechart avg(Value) as Value by host |  appendcols  [search index=test  sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold | search id="1"  |  bucket _time span=5min |  timechart values(threshold) as "threshold"]

The problem is, that the search takes too much time.
Is there a way to make the search faster?

Thanks 🙂

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

View solution in original post

somesoni2
Revered Legend

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

tgdvopab
Path Finder

Thanks a lot for your solution! The search ist very fast now.
Could you explain me, what "appendpipe" and at the end "table" does?

0 Karma

somesoni2
Revered Legend

Since, your first query aggregates based on host and time but second query does only by time, the query before appendpipe is doing summary of both value and threshold (I assume threshold is constant for a host) and appendpipe generate a summary just of time (no host). The eval inside appendpipe subsearch ensure threshold be added as host so that a column/series can be generated by the subsequent timechart.

The last table just does the column ordering _time, "all hosts", threshold

0 Karma

JMichaelis
Path Finder

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up.

Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...