Splunk Search

Time taken for a lookup vs Time taken for a KVstore

VijaySrrie
Builder

Hi,

I have a lookup file which takes some time to load (Look up has 19Lakhs data) - This lookup is used in a dashboard

So, we are planning to move with KV store, and created one.

How do I get the exact time taken to load the lookup and the time taken to load the kvstore?

Is there any command to capture the time taken to load the lookup and the KVstore?

In job inspector  is there any field?

Labels (2)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

View solution in original post

manjunathmeti
SplunkTrust
SplunkTrust

hi @VijaySrrie,

You just need to search both the CSV and KVStore lookups with inputlookup command separately.

Once the search is completed. You can click on Job dropdown below the search bar. Click on Inspect Job and you'll see the first line in the Search job inspector page as below.

This search has completed and has returned 23,448 results by scanning 5,862 events in 0.728 seconds.

You can compare the time taken for both the lookups to load.



If this reply helps you, a like would be appreciated.

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...