Splunk Search

Query Performace

dglass0215
Path Finder

Hello, 

 

I am building a query to be able to display a line graph of status (offline, online) over a period of 30days.  Query currently is so slow it usually doesn't finish.  looking for assistance to see if I can do something different to speed it up.  thanks!

 

Current query:

index=mydata sourcetype="mySourceType" (_raw=*offline* OR _raw=*online*) 
| eval status=if(like(_raw, "%offline%"),"Offline","Online")
| timechart span=1d count by status

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

View solution in original post

0 Karma

bowesmana
Super Champion

Create a field extraction where you extract the current status from raw for that sourcetype, so when you search for it, you can search for all records with status, e.g.

index=mydata sourcetype="mySourceType" status=*
| timechart span=1d count by status

otherwise the leading wildcard combined with _raw= is going to have to search all the data for that sourcetype for your time period. Any row that does not have an extracted status field will not be found.

 

 

0 Karma

dglass0215
Path Finder

Not sure how to do that when the data is unstructured.

0 Karma

bowesmana
Super Champion

Take a look at the field extractor in the UI - you can get there from a raw event, via the Event Actions drop down. Splunk is great at unstructured data and it's really good to take a look at how you do field extractions, as it will help you a lot.

bowesmana_0-1619648505124.png

You can extract fields based on regular expressions or delimiters, if you don't know much about regex, then https://regex101.com is a good place to look to play with regex.

 

0 Karma

manjunathmeti
Champion

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

View solution in original post

0 Karma

dglass0215
Path Finder

Thank you.  This definitely helped to speed it up.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!