Splunk Search
Highlighted

Report Acceleration on subsearch

Communicator

Hi,
I'm trying to apply some search acceleration on a subsearch (using the join command), but I can't seem to get it working. Does anyone know if subsearches can be accelerated?

This is my saved accelerated search:

index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime

If I run the following search separately, the acceleration works perfectly. But when I use this same search within the join command, the search isn't accelerated.

Here's my full search:

index=prod sourcetype=odr | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval count=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",count) | eval Users=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",Users) | eval AvgTime=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",AvgTime) | eval date_wday=if(isnull(date_wday),lower(strftime(_time,"%A")),date_wday) | eval 10mintime=strftime(_time,"%T") | join date_wday, 10mintime [ search index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval 10mintime=strftime(_time,"%T") | eval hitsLowBand=count-(count*0.2) | eval hitsHighBand=(count+(count*0.2))-hitsLowBand | eval timeLowBand=AvgTime-(AvgTime*0.2) | eval timeHighBand=(AvgTime+(AvgTime*0.2))-timeLowBand | eval usersLowBand=Users-(Users*0.2) | eval usersHighBand=(Users+(Users*0.2))-usersLowBand ] | timechart span=10m first(hitsLowBand) as hitsLowBand, first(hitsHighBand) as hitsHighBand, first(count) as Hits, first(timeLowBand) as timeLowBand, first(timeHighBand) as timeHighBand, first(AvgTime) as AvgTime, first(usersLowBand) as usersLowBand, first(usersHighBand) as usersHighBand, first(Users) as Users

Thanks

Highlighted

Re: Report Acceleration on subsearch

Champion

The value of a main search is overwritten by the result of subsearch. Is it necessary to use a subsearch? I think that you should explain what report you want.

(_time),count,AvgTime,Users

0 Karma