Splunk Search

Search optimization



Labels (1)
0 Karma


Does it need optimising?

You're trying to find src values with more than 300 events in a 45s period. 

What is the context? Is it part of a dashboard and what is the wider time period. Optimisations can be done using summary indexes, where you calculate these counts using a scheduled search and then your query can then search the summary which will only contain the results of that query as opposed to the raw data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...