I am trying to create a dashboard of CPU and Memory usage from some log files. Because of the way the data is inputted into Splunk, I first need to do joins over several metrics for a single time in order to calculate a field for that time. I repeat this multiple times, once for each metric I want to calculate for each server. Each of these calculated metrics is plotted as a line on a chart. The query I have takes too long and does not scale (I need to plot more metrics and over a longer time range). Currently: Plotting 2 lines takes 4 seconds Plotting 4 lines takes 8 seconds Plotting 6 lines takes 30 seconds Plotting 8 lines takes 10 minutes In the job inspector, the only thing that takes a substantial amount of time is the join so my guess is that this is what causes the problem. For plotting 6 lines: -dispatch.evaluate (10sec) -dispatch.evaluate.join (10sec) Is the way I am using the join incorrect? For the task I want to do, the time for the query to run should ideally be linear with the number of lines plotted whereas this is clearly not the case here. What can I do to make this run faster? For context, the index stores about 600,000 events in total but only about 1% of the events are useful in my query. This is my query: index=logs "Cpu-user" Server=unixvs54 | rename Value AS "Cpu-user-54" | table _time "Cpu-user-54" | join type=left _time [ search index=logs "Cpu-kernel" Server=unixvs54 | rename Value AS "Cpu-kernel-54" | table _time "Cpu-kernel-54"] | join type=left _time [ search index=logs "Cpu-iowait" Server=unixvs54 | rename Value AS "Cpu-iowait-54" | table _time "Cpu-iowait-54"] | eval "CPU-54 Use %"='Cpu-user-54'+'Cpu-kernel-54'+'Cpu-iowait-54' | join type=left _time [ search index=logs "Memory-phys mem" Server=unixvs54 | rename Value AS "Memory Total-54" | table _time "Memory Total-54"] | join type=left _time [ search index=logs "Memory-free mem" Server=unixvs54 | rename Value AS "Memory Free-54" | table _time "Memory Free-54"] | eval "Memory-54 Use %"=100*(1-('Memory Free-54'/'Memory Total-54')) |join type=left _time [search index=logs "Cpu-user" Server=unixvs56 | rename Value AS "Cpu-user-56" | table _time "Cpu-user-56"] | join type=left _time [ search index=logs "Cpu-kernel" Server=unixvs56 | rename Value AS "Cpu-kernel-56" | table _time "Cpu-kernel-56"] | join type=left _time [ search index=logs "Cpu-iowait" Server=unixvs56 | rename Value AS "Cpu-iowait-56" | table _time "Cpu-iowait-56"] | eval "CPU-56 Use %"='Cpu-user-56'+'Cpu-kernel-56'+'Cpu-iowait-56' | join type=left _time [ search index=logs "Memory-phys mem" Server=unixvs56 | rename Value AS "Memory Total-56" | table _time "Memory Total-56"] | join type=left _time [ search index=logs "Memory-free mem" Server=unixvs56 | rename Value AS "Memory Free-56" | table _time "Memory Free-56"] | eval "Memory-56 Use %"=100*(1-('Memory Free-56'/'Memory Total-56')) |join type=left _time [search index=logs "Cpu-user" Server=unixvs58 | rename Value AS "Cpu-user-58" | table _time "Cpu-user-58"] | join type=left _time [ search index=logs "Cpu-kernel" Server=unixvs58 | rename Value AS "Cpu-kernel-58" | table _time "Cpu-kernel-58"] | join type=left _time [ search index=logs "Cpu-iowait" Server=unixvs58 | rename Value AS "Cpu-iowait-58" | table _time "Cpu-iowait-58"] | eval "CPU-58 Use %"='Cpu-user-58'+'Cpu-kernel-58'+'Cpu-iowait-58' | join type=left _time [ search index=logs "Memory-phys mem" Server=unixvs58 | rename Value AS "Memory Total-58" | table _time "Memory Total-58"] | join type=left _time [ search index=logs "Memory-free mem" Server=unixvs58 | rename Value AS "Memory Free-58" | table _time "Memory Free-58"] | eval "Memory-58 Use %"=100*(1-('Memory Free-58'/'Memory Total-58')) | table _time "CPU-54 Use %" "Memory-54 Use %" "CPU-56 Use %" "Memory-56 Use %" "CPU-58 Use %" "Memory-58 Use %" This is what I'm trying to do (in case someone knows of a better query to do this) Additional image for comment below (can't upload images in comment). ... View more