Splunk Search
Highlighted

append or multi search

Trying to make search more efficient.  Any tips? Would multi search work more efficiently?

index=<myindex> sourcetype="cisco_cdr" duration > 0 earliest=-1d@d latest=@d
| rename callingPartyUnicodeLoginUserID AS SID
| where match(SID, "[A-Za-z]\d{6}")
| eval Calls_Made_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d")
| stats count as Calls_Made sum(duration) as Calls_Made_Duration by Date Day SID
| append
[| search index=<myindex> sourcetype="cisco_cdr" duration > 0
earliest=-1d@d latest=@d
| rename finalCalledPartyUnicodeLoginUserID AS SID
| where match(SID, "[A-Za-z]\d{6}")
| eval Calls_Received_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d")
| stats count as Calls_Received sum(duration) as Calls_Received_Duration by Date Day SID ]
| stats values(*) as * by Date Day SID
| fillnull value="0"
| eval Total_Duration=(Calls_Made_Duration+Calls_Received_Duration)
| where Total_Duration > 0
| table SID Date Day Calls_Made Calls_Made_Duration Calls_Received Calls_Received_Duration Total_Duration

Labels (2)
0 Karma
Highlighted

Re: append or multi search

SplunkTrust
SplunkTrust
Use multisearch. It runs both subsearches in parallel and is not subject to the same limitations as append.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: append or multi search

Builder

@eus_e2e_engineeI'm not seeing a need for the append or the second search, as everything before the first pipe in both searches is the same. If there's no case, then that is indeed inefficient. Collect everything up front and then categorize away using evals.

What you may be running into, is a filtering out of fields due to the stats command. If that's the case, I'd look into using eventstats and/or streamstats instead of stats. There's an old but relevant blog post here about those: https://www.splunk.com/en_us/blog/tips-and-tricks/search-command-stats-eventstats-and-streamstats-2....

###

If this reply helps you, an upvote would be appreciated.

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.