Splunk Search

Report Acceleration on subsearch

ashleyherbert
Communicator

Hi,
I'm trying to apply some search acceleration on a subsearch (using the join command), but I can't seem to get it working. Does anyone know if subsearches can be accelerated?

This is my saved accelerated search:

index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime

If I run the following search separately, the acceleration works perfectly. But when I use this same search within the join command, the search isn't accelerated.

Here's my full search:

index=prod sourcetype=odr | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval count=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",count) | eval Users=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",Users) | eval AvgTime=if(strftime(_time,"%H%M")>=strftime(now(),"%H%M"),"",AvgTime) | eval date_wday=if(isnull(date_wday),lower(strftime(_time,"%A")),date_wday) | eval 10mintime=strftime(_time,"%T") | join date_wday, 10mintime [ search index=prod sourcetype=odr earliest=-3mon@mon latest=@d | timechart span=10m latest(date_wday) as date_wday, count, dc(cs_username) as Users, avg(time_taken) as AvgTime | eval 10mintime=strftime(_time,"%T") | eval hitsLowBand=count-(count*0.2) | eval hitsHighBand=(count+(count*0.2))-hitsLowBand | eval timeLowBand=AvgTime-(AvgTime*0.2) | eval timeHighBand=(AvgTime+(AvgTime*0.2))-timeLowBand | eval usersLowBand=Users-(Users*0.2) | eval usersHighBand=(Users+(Users*0.2))-usersLowBand ] | timechart span=10m first(hitsLowBand) as hitsLowBand, first(hitsHighBand) as hitsHighBand, first(count) as Hits, first(timeLowBand) as timeLowBand, first(timeHighBand) as timeHighBand, first(AvgTime) as AvgTime, first(usersLowBand) as usersLowBand, first(usersHighBand) as usersHighBand, first(Users) as Users

Thanks

HiroshiSatoh
Champion

The value of a main search is overwritten by the result of subsearch. Is it necessary to use a subsearch? I think that you should explain what report you want.

(_time),count,AvgTime,Users

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...