Speeding up Search in Timechart and D3

[kteki1]

Hi,

I am using D3 Chart to display the output from the following query:

sourcetype=WinEventLog:Security  | timechart span=1h count as total | appendcols [search 
sourcetype=WinEventLog:Security | timechart span=1h count by eventtype   ] | table _time * total

And I have used report acceleration to get faster results for this query. Currently it takes over five minutes to process and display the query.

Any ideas to speed up the query?

[lguinn2 · Accepted solution]

Avoid appendcols or join.

sourcetype=WinEventLog:Security  
| timechart span=1h count by eventtype 
| addtotals

Should be at least twice as fast.