About dlamas_splunk

aweitzman · ‎11-06-2014

I think I've solved this problem by accelerating the data model. Not only does this make most of the searches faster generally, but it seems to short-circuit the "search everything" process and allow it to only search the data within the timeframe of the search, even when it's outside the boundaries of the acceleration. Seems curious that it would behave that way, but there you go.

dlamas_splunk · ‎11-12-2013

Take a look at the pivot search command. Pivot Command Docs Field lineage is used to prevent name collisions. Since the Pivot command specifies an object, you can use fieldName sans qualification. If the Data Model is accelerated, it will build the tstats query for you. You can get an idea of how to build | pivot searches by using the UI and then clicking "Open in Search."

iKate · ‎09-26-2014

dragging panels in Launcher doesn't change order in the apps' dropdown in the upper left corner. Or which dropdown did you mean?

hrdwdmrbl · ‎06-05-2018

This is also very slow! I had to use sampling to get some results. 1. Can someone explain why its slow? 2. Any other suggestions to speed it up?

Posts	8
Solutions	1
Karma Given	1
Karma Received	11
Member Since	‎11-15-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Re: Why does an initial pivot search take so long?

Re: using data model qualified names

Re: Splunk 6 launcher shows apps in reverse order

Re: Can Splunk filter/match events and bring back ...