Hi,
I'm trying to apply some search acceleration on a subsearch (using the join command), but I can't seem to get it working. Does anyone know if subsearches can be accelerated?
This is my saved accelerated search:
index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime
If I run the following search separately, the acceleration works perfectly. But when I use this same search within the join command, the search isn't accelerated.
Here's my full search:
index=prod sourcetype=odr | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval count=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",count) | eval Users=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",Users) | eval AvgTime=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",AvgTime) | eval date_wday=if(isnull(date_wday),lower(strftime(_time,"%A")),date_wday) | eval 10mintime=strftime(_time,"%T") | join date_wday, 10mintime [ search index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval 10mintime=strftime(_time,"%T") | eval hitsLowBand=count-(count*0.2) | eval hitsHighBand=(count+(count*0.2))-hitsLowBand | eval timeLowBand=AvgTime-(AvgTime*0.2) | eval timeHighBand=(AvgTime+(AvgTime*0.2))-timeLowBand | eval usersLowBand=Users-(Users*0.2) | eval usersHighBand=(Users+(Users*0.2))-usersLowBand ] | timechart span=10m first(hitsLowBand) as hitsLowBand, first(hitsHighBand) as hitsHighBand, first(count) as Hits, first(timeLowBand) as timeLowBand, first(timeHighBand) as timeHighBand, first(AvgTime) as AvgTime, first(usersLowBand) as usersLowBand, first(usersHighBand) as usersHighBand, first(Users) as Users
Thanks
