Hello @inventsekar, Thank you for your response and for sharing the details. 1. Yes, I used summary indexing to improve the performance of the search query. 2. Yes, the Splunk infrastructure is a clustered environment. Thank you for sharing the documents for improving search performance and for sharing that Splunk can run the search without any negative implications or major issues. Taruchit ... View more

Hello @inventsekar, Thank you for your response and for sharing the details. I searched about healthcheckup and found it gives information related to configuration changes. I check Job Details dashboard and fetched details of average indexer time which is around 0.9 seconds and time taken by the search to run on each indexer which varied between 0.8 to 1.5 seconds. Thus, can you please share if its suitable to run the scheduled search over Splunk infrastructure or if it can lead to negative implications and issues? The reason to ask is because its scheduled search and cannot afford search failure or infrastructure breakdown, and thus, want to be sure of using the approach. Thank you ... View more

Hello @isoutamo, Thank you for your response. The scheduled SPL is a report scheduled to run each minute to fetch datapoints for different conditions in each iteration and store them in lookup file so that later I can use the lookup file to directly read data for my analysis and also in dashboards and alerts. This helps to access data faster and load dashboard with all relevant information with lesser time than reading and displaying the data from index. This also helps to access required historical data faster than fetching from index. So as I understand from your inputs, in my current situation all relevant Splunk components are reserved for the scheduled search each minute for 4 seconds for the period of 1 hour. And thus, it works as a normal historical scheduled search with no extra resource workload or causing slowness, breakdowns in Splunk infrastructure due to its implementation. Please share if there is anything else that I need to correct or understand with this implementation. Thank you ... View more

Hi @Sid, I wasn't able to get the solution yet. Thank you ... View more

Hello @ITWhisperer, I had used the below SPL for reading the values from lookup file and storing their corresponding SPL back in the lookup file which I wanted to use for computing the respective forecasted values. |inputlookup table1.csv |table fieldA, fieldB |eval key="index=custom_index earliest=-4w@w latest-2d@d orig_fieldA=".fieldA." orig_fieldB=".fieldB." |timechart span=1d avg(event_count) AS avg_event_count |predict avg_event_count future_timespan=1 |tail 1 |fields prediction(avg_event_count)" |outputlookup table1.csv Shared the above SPL for your reference incase you could suggest any improvement in the approach for achieving the end result. Thanking you in anticipation. ... View more

Hello @ITWhisperer, Thank you for your response and for sharing your inputs and questions. I will try to describe the original task and hopefully in the process will be able to answer your questions. I have a lookup file with two fields: fieldA, fieldB. The lookup file has distinct pairs of fieldA and fieldB. I have an index and I need to run predict command to calculate event count for each pair of fieldA and fieldB listed in lookup file to forecast the value of last day by taking historical data of last 1 month span by a day. As the result, the query I used to compute the timeseries data for giving input to predict command is a timechart command. I have to store the resulting forecasted value in the lookup for respective pairs of fieldA and fieldB. Then use the lookup for reading the its data in the dashboard and also display the actual value of event count for each distinct pair of fieldA and fieldB for comparison.  The approach I tried so far: - I tried to read the data from lookup file for each row, build the SPL for each row that uses timechart command to fetch timeseries data, then use it in predict command to compute the forecasted value; finally stored the SPL for each lookup in the third column of the lookup. The approach was to first build the required SPL for each row of unique pairs and then iteratively run the SPL from the lookup to compute the required values. However, I got stuck in reading the SPLs and storing their values back in the lookup.   I will now try to answer your specific questions: - Ideally, I would want to execute these searches in one main search or iteratively get executed in the main search. With regards to error in one of the SPL searches, the error is not anticipated because the search conditions and SPL keywords are same, only the values change based on the row that is currently being accessed in the lookup file. The lookup file more or less may have fixed number of rows but it will periodically get updated by a different search that refreshes its data. The SPL searches are complete search which can be executed independently on the search head to compute the predicted values.   Please share if you need any more details from my end for seeking your inputs. Thank you ... View more

Hi @isoutamo, The current count is under 150. Thank you   ... View more

Hello @isoutamo, The data is in the lookup file is in the form below, I need to read data from each row and compute the results: - index sourcetype ----------------------- idx1 s1 idx2 s2 idx3 s3 idx1 s4 Now I need to compute and display results of each row by running predict command on each of them.  The base query that I have built for running predict command that will fetch the forecast values for each row: - index=custom_index orig_index=idx1 orig_sourcetype=s1 earliest=-4w@w latest=-2d@d | timechart span=1d avg(event_count) AS avg_event_count | predict avg_event_count | tail 1 | fields prediction(avg_event_count)   Please share if you need any more details from my end. I hope to seek your inputs on solving the problem. Thank you ... View more

Hi @ashok968, Can you please share your current SPL and its output and a visual representation of what output you may need to fulfill the requirement? Please mask the relevant sensitive content if any. Thank you ... View more

I tried to build below SPL so far:- |inputlookup table1.csv |table index, sourcetype |eval key="index=custom_index orig_index=".index." orig_sourcetype=".sourcetype." | timechart span=1d avg(event_count) AS avg_event_count |predict avg_event_count future_timespan=1 |tail 1 | fields prediction(avg_event_count)" With above SPL, I get three columns: index, sourcetype and key. In column key, I get the corresponding SPL of the row. Thus, I need help to execute and generate results for each row. Thank you ... View more

Hi @tscroggins, Thank you very much for sharing the detailed inputs and also for also sharing the alternate approaches for exploring. Thank you ... View more

Hi @ITWhisperer  Thank you very much for your prompt help. Thank you ... View more

Thank you for sharing. ... View more

Hi @richgalloway, Is there no repository or directory in Splunk that stores the results seen in Job inspector? Like when we have scheduled searches, we can see job inspector and its data of atleast past two results. So, do we have any way to fetch that data via SPL, at least till TTL of those search does not expire? Thank you ... View more

Hi @richgalloway, Thank you for sharing.  Taruchit ... View more