Splunk Search
Highlighted

Make search faster

Path Finder

Hello

I have the following search:

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1" |  timechart avg(Value) as Value by host |  appendcols  [search index=test  sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold | search id="1"  |  bucket _time span=5min |  timechart values(threshold) as "threshold"]

The problem is, that the search takes too much time.
Is there a way to make the search faster?

Thanks 🙂

0 Karma
Highlighted

Re: Make search faster

Path Finder

Making the lookup automatic would allow you to pull the limitation "search id="1"" into the base search which should speed things up.

Highlighted

Re: Make search faster

SplunkTrust
SplunkTrust

Try this

index=test sourcetype=Perfmon:* | lookup khi_threshold_id counter AS counter object AS object OUTPUTNEW description AS description id AS id threshold AS threshold  | search id="1"
| bucket span=5m _time | stats avg(Value) as Value values(threshold) as threshold by _time host
| appendpipe [stats values(threshold) as Value by _time | eval host="threshold"]
| timechart avg(Value) as Value by host  | table _time * threshold

View solution in original post

Highlighted

Re: Make search faster

Path Finder

Thanks a lot for your solution! The search ist very fast now.
Could you explain me, what "appendpipe" and at the end "table" does?

0 Karma
Highlighted

Re: Make search faster

SplunkTrust
SplunkTrust

Since, your first query aggregates based on host and time but second query does only by time, the query before appendpipe is doing summary of both value and threshold (I assume threshold is constant for a host) and appendpipe generate a summary just of time (no host). The eval inside appendpipe subsearch ensure threshold be added as host so that a column/series can be generated by the subsequent timechart.

The last table just does the column ordering _time, "all hosts", threshold

0 Karma