Splunk Search

What do "total_slices" represent in the audittrail?

briancronrath
Contributor

I have been investigating a particular search an api user runs which has become markedly slower past a specific date.  When looking in the audittrail internal logs, what I noticed is that there is no significant increase in event count, however the "total_slices" number significantly increases from before the date through after the date.

I couldn't find much information in the documentation on what this value represents.  Does this mean the data within each event increased around that time?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A "slice" is a portion of a bucket.  The audit record is trying to show how much data was read to satisfy the search.

---
If this reply helps you, Karma would be appreciated.

briancronrath
Contributor

Thank you Rich!  Does it seem odd though that the underlying size of the events hasn't changed through this time?  What might be causing it to have to search through more slices for the same style format and volume of data?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

On the surface, yes it's a little odd, but it's hard to say for sure without knowing more about the nature of the data and the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @briancronrath,

Surprisingly, there are no documentations about this "total_slices" in Splunk docs. 

As I checked the audit logs, I could see there are two fields with the word "slices"... 

total_slices and decompressed_slices 

 

index="_audit" | fields total_slices decompressed_slices | stats count by total_slices decompressed_slices

index="_audit" total_slices | fields user total_slices decompressed_slices | stats count by total_slices decompressed_slices user

 

 these two searches may give you some ideas. (but maynot give much i hope).
maybe lets wait for Splunk Guru's reply, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...