Currently our DB Collect Version is 3.1.3 and we are upgrading to Splunk Version 8. Just wanted to check do we need to upgrade our DB Collect as well. ... View more

Trying to make search more efficient.  Any tips? Would multi search work more efficiently? index=<myindex> sourcetype="cisco_cdr" duration > 0 earliest=-1d@d latest=@d | rename callingPartyUnicodeLoginUserID AS SID | where match(SID, "[A-Za-z]\d{6}") | eval Calls_Made_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d") | stats count as Calls_Made sum(duration) as Calls_Made_Duration by Date Day SID | append [| search index=<myindex> sourcetype="cisco_cdr" duration > 0 earliest=-1d@d latest=@d | rename finalCalledPartyUnicodeLoginUserID AS SID | where match(SID, "[A-Za-z]\d{6}") | eval Calls_Received_cob_date = strftime(_time, "%Y-%m-%d") ,Day=strftime(_time,"%a"),Date=strftime(_time, "%Y-%m-%d") | stats count as Calls_Received sum(duration) as Calls_Received_Duration by Date Day SID ] | stats values(*) as * by Date Day SID | fillnull value="0" | eval Total_Duration=(Calls_Made_Duration+Calls_Received_Duration) | where Total_Duration > 0 | table SID Date Day Calls_Made Calls_Made_Duration Calls_Received Calls_Received_Duration Total_Duration ... View more