What do "total_slices" represent in the audittrail?

[briancronrath]

I have been investigating a particular search an api user runs which has become markedly slower past a specific date.  When looking in the audittrail internal logs, what I noticed is that there is no significant increase in event count, however the "total_slices" number significantly increases from before the date through after the date.

I couldn't find much information in the documentation on what this value represents.  Does this mean the data within each event increased around that time?

[richgalloway]

A "slice" is a portion of a bucket.  The audit record is trying to show how much data was read to satisfy the search.

[briancronrath]

Thank you Rich!  Does it seem odd though that the underlying size of the events hasn't changed through this time?  What might be causing it to have to search through more slices for the same style format and volume of data?

[richgalloway]

On the surface, yes it's a little odd, but it's hard to say for sure without knowing more about the nature of the data and the search.

[inventsekar]

Hi @briancronrath,

Surprisingly, there are no documentations about this "total_slices" in Splunk docs. 

As I checked the audit logs, I could see there are two fields with the word "slices"... 

total_slices and decompressed_slices 

index="_audit" | fields total_slices decompressed_slices | stats count by total_slices decompressed_slices

index="_audit" total_slices | fields user total_slices decompressed_slices | stats count by total_slices decompressed_slices user

 these two searches may give you some ideas. (but maynot give much i hope).
maybe lets wait for Splunk Guru's reply, thanks.