Splunk Search

What is the quickest way to find 100 max values of "Q" on huge log file?

indeed_2000
Motivator

Hi

What is the quickest way to find 100 max values of "Q" on huge log file?

 

here is my query:

index="myindex" |  rex "Q\[(?<Q>\d+) | stats max(Q)

 

here is the log:

13:58:34.999  Q[16]

 

Any idea?

Thanks

Labels (3)
Tags (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="myindex" | rex "Q\[(?<Q>\d+)" | stats max(Q)
0 Karma

indeed_2000
Motivator

@ITWhispererThanks for answer. what is the different?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The difference is mine will work, yours won't! 😀

"status" isn't a valid SPL command

Adding the field name to the rex expression identifies what the field is to be called.

0 Karma

indeed_2000
Motivator

@ITWhisperer actually i have performance issue, original post modified, I had typo.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than extracting the Q field at search time, you could consider extracting it at index time (transform/props .conf). That would at least remove the rex processing when trying to determine the max.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could also try creating a summary index with the max values every minute for example, then look for the max in the summary index events rather than the raw events.

0 Karma

indeed_2000
Motivator

@ITWhisperer actually this is summary index 🙂 and still huge!
I try to use transform too but increase index time drastically !

Any other idea?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try a summary of the summary in larger timeslices.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...