Splunk Search

What do "total_slices" represent in the audittrail?

briancronrath
Contributor

I have been investigating a particular search an api user runs which has become markedly slower past a specific date.  When looking in the audittrail internal logs, what I noticed is that there is no significant increase in event count, however the "total_slices" number significantly increases from before the date through after the date.

I couldn't find much information in the documentation on what this value represents.  Does this mean the data within each event increased around that time?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

A "slice" is a portion of a bucket.  The audit record is trying to show how much data was read to satisfy the search.

---
If this reply helps you, Karma would be appreciated.

briancronrath
Contributor

Thank you Rich!  Does it seem odd though that the underlying size of the events hasn't changed through this time?  What might be causing it to have to search through more slices for the same style format and volume of data?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

On the surface, yes it's a little odd, but it's hard to say for sure without knowing more about the nature of the data and the search.

---
If this reply helps you, Karma would be appreciated.
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @briancronrath,

Surprisingly, there are no documentations about this "total_slices" in Splunk docs. 

As I checked the audit logs, I could see there are two fields with the word "slices"... 

total_slices and decompressed_slices 

 

index="_audit" | fields total_slices decompressed_slices | stats count by total_slices decompressed_slices

index="_audit" total_slices | fields user total_slices decompressed_slices | stats count by total_slices decompressed_slices user

 

 these two searches may give you some ideas. (but maynot give much i hope).
maybe lets wait for Splunk Guru's reply, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...