Splunk Search

Query Performace

dglass0215
Path Finder

Hello, 

 

I am building a query to be able to display a line graph of status (offline, online) over a period of 30days.  Query currently is so slow it usually doesn't finish.  looking for assistance to see if I can do something different to speed it up.  thanks!

 

Current query:

index=mydata sourcetype="mySourceType" (_raw=*offline* OR _raw=*online*) 
| eval status=if(like(_raw, "%offline%"),"Offline","Online")
| timechart span=1d count by status

Labels (1)
0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Create a field extraction where you extract the current status from raw for that sourcetype, so when you search for it, you can search for all records with status, e.g.

index=mydata sourcetype="mySourceType" status=*
| timechart span=1d count by status

otherwise the leading wildcard combined with _raw= is going to have to search all the data for that sourcetype for your time period. Any row that does not have an extracted status field will not be found.

 

 

0 Karma

dglass0215
Path Finder

Not sure how to do that when the data is unstructured.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Take a look at the field extractor in the UI - you can get there from a raw event, via the Event Actions drop down. Splunk is great at unstructured data and it's really good to take a look at how you do field extractions, as it will help you a lot.

bowesmana_0-1619648505124.png

You can extract fields based on regular expressions or delimiters, if you don't know much about regex, then https://regex101.com is a good place to look to play with regex.

 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @dglass0215,
You don't need to use wildcard (*) in the base search. Try the below query without the timechart first and check the performance. Then add timechart and check the performance.

index=mydata sourcetype="mySourceType" offline OR online 
| rex "(?<status>offline)" 
| eval status=if(status="offline","Offline","Online")

 

0 Karma

dglass0215
Path Finder

Thank you.  This definitely helped to speed it up.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...