Splunk Search

Query Performace

dglass0215
Path Finder

Hello, 

 

I am building a query to be able to display a line graph of status (offline, online) over a period of 30days.  Query currently is so slow it usually doesn't finish.  looking for assistance to see if I can do something different to speed it up.  thanks!

 

Current query:

index=mydata sourcetype="mySourceType" (_raw=*offline* OR _raw=*online*) 
| eval status=if(like(_raw, "%offline%"),"Offline","Online")
| timechart span=1d count by status

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Create a field extraction where you extract the current status from raw for that sourcetype, so when you search for it, you can search for all records with status, e.g.

index=mydata sourcetype="mySourceType" status=*
| timechart span=1d count by status

otherwise the leading wildcard combined with _raw= is going to have to search all the data for that sourcetype for your time period. Any row that does not have an extracted status field will not be found.

 

 

0 Karma

dglass0215
Path Finder

Not sure how to do that when the data is unstructured.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Take a look at the field extractor in the UI - you can get there from a raw event, via the Event Actions drop down. Splunk is great at unstructured data and it's really good to take a look at how you do field extractions, as it will help you a lot.

bowesmana_0-1619648505124.png

You can extract fields based on regular expressions or delimiters, if you don't know much about regex, then https://regex101.com is a good place to look to play with regex.

 

0 Karma

manjunathmeti
Champion

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

0 Karma

dglass0215
Path Finder

Thank you.  This definitely helped to speed it up.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...