Optimizing a search in splunk

[gimbil]

Hi,

I am trying to do a search which basically generates measures based on the value of a field such as X:

search logs|…..| timechart count(eval(X="1" OR X="2")) AS "A",  count(eval(X="1")) AS "B",  count(eval(X="2")) AS "C",  count(eval(X="3")) AS "D", count(eval(X="4" OR X="5" OR X="6")) as "E" span=1d

however, generating results takes for ever. If I remove some of the counts (like the one to generate "E") it becomes much faster. Is there anyway to better optimize this search?

Thanks

[ShaneNewman]

The answer given by somesoni2 will make it more efficient. The other option is to create a summary index, then search the summary index.

[mdmaala]

how to create a summary index and how will I call it in the search bar?

[kamlesh_vaghela]

@mdmaala

Below link will help you.

https://github.com/packetiq/SplunkArchitect/blob/master/Creating-and-Using-Summary-Indexes.md

[somesoni2]

Try following

search logs|…..| eval countField=case(X="1" OR X="2","A",X="1","B",X="2","C",X="3","D",X="4" OR X="5" OR X="6","E",1=1,"E") | timechart count(eval(countfield="A"))AS "A", count(countfield="B") AS "B", count(eval(countfield="C")) AS "C", count(eval(countfield="D")) AS "D", count(eval(countfield="E")) as "E" span=1d