Splunk Search

How to make my simple timechart search run faster?

adamsmith47
Communicator

I'm guessing this should be a very basic task, if it's possible.

My current search below produces exactly what I want, but is too slow:

index=<myindex> sourcetype=<mysourcetype> earliest=-7d@d| timechart span=1h count

However, the individual events are large (sometimes hundreds of lines), the event counts are large (several hundred thousand), and there are dozens of field extractions occurring for these events, so, the search takes a while to complete.

In an effort to make it faster, I'm using this with success (about 1/8th the time to complete):

index=<myindex> sourcetype=<mysourcetype> earliest=-7d@d | fields + index sourcetype| timechart span=1h count

However, I'm wondering if there's an easy, faster way to accomplish the same thing. Perhaps with tstats?

Any help is appreciated.

0 Karma

jethompson_splu
Splunk Employee
Splunk Employee

Hello adamsmith47,

You will want to setup an Accelerated Report. This will help to reduce the amount of time that it takes for this type of search to complete. The following is a link to the Documentation for setting up Accelerated Reports:

http://docs.splunk.com/Documentation/Splunk/latest/Report/Acceleratereports

0 Karma

adonio
Ultra Champion

| tstats count WHERE index = index sourcetype = sourcetype earliest = sometime BY _time
you can add span and other components to the command. More about | tstats here: https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Tstats

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...