Splunk Search

Slow child dataset

AKG1_old1
Builder

Hello,

Currently, we are using multiple datamodels for same data (post filters are different). Now we are trying to merge them in single datamodel using child dataset to decrease disk space but appently there is massive performance impact on tstats search queries using child dataset.

In below example, while using child dataset Its almost 300+% increase in search time.

This might be expected as scaning full set of logs. Checking if there is any other way of using tstat query on child dataset to improve performace ?

alt text

Datamodel structure
alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...