Splunk Search

How to make search faster

kteng2024
Path Finder

Hello,

below is my search . Since i am using join , search is slow . Can i please know if there is a way to increase the speed of the search rather than absolutely specifying the index.

| tstats max(time) as lastReport WHERE splunk_server_group=abc index=*_abc* OR index=main by host | eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") | table LastReported host |join host [search index=_internal hostname=* | stats count by hostname sourceIp| rename hostname as host ]

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kteng2024

Can you please try this?

| tstats max(_time) as lastReport WHERE splunk_server_group=abc index=abc OR index=main by host 
| eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") 
| fields LastReported host 
| append 
    [ search index=_internal hostname=* 
    | stats count by hostname sourceIp 
    | rename hostname as host ] | stats values(sourceIp) as sourceIp values(LastReported) as LastReported by host
0 Karma

Elsurion
Communicator

A short win is when you add

| fields hostname, sourceIp

to your search, on my system it gave me about a win of 50% searchtime from 22sec to 11sec over a period of 60mins

Other question is, what are you expecting from your search here? Just a list when a certain host has sent last it's data?

0 Karma

mayurr98
Super Champion

Have you tried doing report acceleration?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...