Splunk Search

Time taken for a lookup vs Time taken for a KVstore

VijaySrrie
Builder

Hi,

I have a lookup file which takes some time to load (Look up has 19Lakhs data) - This lookup is used in a dashboard

So, we are planning to move with KV store, and created one.

How do I get the exact time taken to load the lookup and the time taken to load the kvstore?

Is there any command to capture the time taken to load the lookup and the KVstore?

In job inspector  is there any field?

Labels (2)
0 Karma
1 Solution

manjunathmeti
Champion

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...