append or multi search

[eus_e2e_enginee]

Trying to make search more efficient.  Any tips? Would multi search work more efficiently?

index=<myindex> sourcetype="cisco_cdr" duration > 0 earliest=-1d@d latest=@d
| rename callingPartyUnicodeLoginUserID AS SID
| where match(SID, "[A-Za-z]\d{6}")
| eval Calls_Made_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d")
| stats count as Calls_Made sum(duration) as Calls_Made_Duration by Date Day SID
| append
[| search index=<myindex> sourcetype="cisco_cdr" duration > 0
earliest=-1d@d latest=@d
| rename finalCalledPartyUnicodeLoginUserID AS SID
| where match(SID, "[A-Za-z]\d{6}")
| eval Calls_Received_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d")
| stats count as Calls_Received sum(duration) as Calls_Received_Duration by Date Day SID ]
| stats values(*) as * by Date Day SID
| fillnull value="0"
| eval Total_Duration=(Calls_Made_Duration+Calls_Received_Duration)
| where Total_Duration > 0
| table SID Date Day Calls_Made Calls_Made_Duration Calls_Received Calls_Received_Duration Total_Duration

[efavreau]

@eus_e2e_engineeI'm not seeing a need for the append or the second search, as everything before the first pipe in both searches is the same. If there's no case, then that is indeed inefficient. Collect everything up front and then categorize away using evals.

What you may be running into, is a filtering out of fields due to the stats command. If that's the case, I'd look into using eventstats and/or streamstats instead of stats. There's an old but relevant blog post here about those: https://www.splunk.com/en_us/blog/tips-and-tricks/search-command-stats-eventstats-and-streamstats-2....

###

If this reply helps you, an upvote would be appreciated.

[richgalloway]

Use multisearch. It runs both subsearches in parallel and is not subject to the same limitations as append.