Splunk Search

how to reduce the time of a search?

francesco1g
Engager

Hi, I have a search that contains millions of events and is extremely slow, is there a way to speed it up?

 

This is the query:

 

index=audit
| table db_name 
| dedup db_name
| outputlookup audit.csv

 

 

Labels (2)
Tags (2)
0 Karma
1 Solution

ashvinpandey
Contributor

@francesco1g try the below one:

index=audit db_name=* | fields db_name | dedup db_name | table db_name 
| outputlookup audit.csv

Also, If this reply helps you, an upvote would be appreciated. 

View solution in original post

ashvinpandey
Contributor

@francesco1g try the below one:

index=audit db_name=* | fields db_name | dedup db_name | table db_name 
| outputlookup audit.csv

Also, If this reply helps you, an upvote would be appreciated. 

gcusello
Legend

Hi @francesco1g,

the only approach when you have to manage million or more data to have fast searches is acceleration:

https://docs.splunk.com/Documentation/Splunk/8.2.2/Report/Acceleratereports

https://docs.splunk.com/Documentation/Splunk/8.2.1/Knowledge/Aboutsummaryindexing

https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Acceleratedatamodels

In your situation, the easiest way is to schedule your search to run e.g. every day or every hur, or in another time period with less events; then write results in a sumamry index and then run your search on the summary index.

Or create an accelerated Datamodel with few fields, only the ones you need.

Ciao.

Giuseppe

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>