@bowesmana @ITWhisperer @inventsekar This is where it it taking more time from inspect job Duration (seconds) Component Invocations Input count Output count 2,133.38 command.search 6,598 32,047,620 64,095,240 52.30 command.search.calcfields 9,307 32,196,524 32,196,524 0.00 command.search.evalfilter 9,307 32,196,524 32,196,524 69.98 command.search.fieldalias 9,307 32,196,524 32,196,524 23.20 command.search.filter 9,307 32,196,524 32,047,620 213.23 command.search.lookups 9,307 32,196,524 32,196,524 1,219.75 command.search.typer 9,307 32,047,620 32,047,620 56.40 command.search.tags 9,307 32,047,620 32,047,620 6.95 command.search.track_sourcetypes 3,299 - - 0.01 dispatch.preview.write_results_to_disk 30 - - 7.64 dispatch.process_remote_timeline 1,860 19,383,546 - 3.95 dispatch.remote_timeline_fullevents 1,034 11,207,755 5,400 0.00 dispatch.stream.local 1 - - 2,171.22 dispatch.stream.remote 3,298 - 70,330,684 31.46 command.regex 3,299 32,047,620 15495 Following is phase0 search value from job inspector litsearch (cs_method=POST (__f!=v OR environment=prod) (index=iis_openapi OR index=iis_securehostopenapi OR index=iis_securepayment) (index!=dp_sec_log OR index!=log-vdi-prod OR index!=idm-win-other OR index!=www_app OR index!=www_app) _time>=1680523200.000 _time<1680537600.000) | litsearch (cs_method=POST environment=prod (index=iis_openapi OR index=iis_securehostopenapi OR index=iis_securepayment) (index!=dp_sec_log OR index!=log-vdi-prod OR index!=idm-win-other OR index!=www_app OR index!=www_app) _time>=1680523200.000 _time<1680537600.000) | regex cs_uri_stem=(?i)"/account/v1/login/forgot-password" | eval Hour=strftime('_time',"%H") | bin _time span=1m | addinfo type=count label=prereport_events track_fieldmeta_events=true | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "_time" "host" "index" "linecount" "prestats_reserved_*" "psrsvd_*" "source" "sourcetype" "splunk_server" | remotetl nb=300 et=1680523200.000000 lt=1680537600.000000 max_count=1000 max_prefetch=100 | prestats count by _time
... View more