Splunk Search

Time taken for a lookup vs Time taken for a KVstore

VijaySrrie
Builder

Hi,

I have a lookup file which takes some time to load (Look up has 19Lakhs data) - This lookup is used in a dashboard

So, we are planning to move with KV store, and created one.

How do I get the exact time taken to load the lookup and the time taken to load the kvstore?

Is there any command to capture the time taken to load the lookup and the KVstore?

In job inspector  is there any field?

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...