Splunk Search

how to save calculated fields in index for faster results

disha
Contributor

I am getting events like _time,boxid,MemoryUsage(bytes),filed1,field2,..

I need to run the search something like
...|spath|rename BOXID as ID,MU as mu|eval mu1=round((mu/1024),2)|timechart limit=0 first(mu1) by ID

for last 7 days or more this chart take so much time to load. Can I calculate mu1 (memory usage in mb) and write the value to splunk in advance so that at the time of chart loading, I just read the value and display.

Please suggest.

Thanks,
Disha

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Well, yes, of course.

Have a look at Accelerated Searches or Summary Indexing.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing

Just saving the results of the calculation round((mu/1024),2) won't improve performance significantly.

/K

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...