Splunk Search

how to reduce the time of a search?

francesco1g
Engager

Hi, I have a search that contains millions of events and is extremely slow, is there a way to speed it up?

 

This is the query:

 

index=audit
| table db_name 
| dedup db_name
| outputlookup audit.csv

 

 

Labels (2)
Tags (2)
0 Karma
1 Solution

ashvinpandey
Contributor

@francesco1g try the below one:

index=audit db_name=* | fields db_name | dedup db_name | table db_name 
| outputlookup audit.csv

Also, If this reply helps you, an upvote would be appreciated. 

View solution in original post

ashvinpandey
Contributor

@francesco1g try the below one:

index=audit db_name=* | fields db_name | dedup db_name | table db_name 
| outputlookup audit.csv

Also, If this reply helps you, an upvote would be appreciated. 

gcusello
Esteemed Legend

Hi @francesco1g,

the only approach when you have to manage million or more data to have fast searches is acceleration:

https://docs.splunk.com/Documentation/Splunk/8.2.2/Report/Acceleratereports

https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/Aboutsummaryindexing

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Acceleratedatamodels

In your situation, the easiest way is to schedule your search to run e.g. every day or every hur, or in another time period with less events; then write results in a sumamry index and then run your search on the summary index.

Or create an accelerated Datamodel with few fields, only the ones you need.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...