Hi,
I am trying to do a search which basically generates measures based on the value of a field such as X:
search logs|…..| timechart count(eval(X="1" OR X="2")) AS "A", count(eval(X="1")) AS "B", count(eval(X="2")) AS "C", count(eval(X="3")) AS "D", count(eval(X="4" OR X="5" OR X="6")) as "E" span=1d
however, generating results takes for ever. If I remove some of the counts (like the one to generate "E") it becomes much faster. Is there anyway to better optimize this search?
Thanks
The answer given by somesoni2 will make it more efficient. The other option is to create a summary index, then search the summary index.
how to create a summary index and how will I call it in the search bar?
@mdmaala
Below link will help you.
https://github.com/packetiq/SplunkArchitect/blob/master/Creating-and-Using-Summary-Indexes.md
Try following
search logs|…..| eval countField=case(X="1" OR X="2","A",X="1","B",X="2","C",X="3","D",X="4" OR X="5" OR X="6","E",1=1,"E") | timechart count(eval(countfield="A"))AS "A", count(countfield="B") AS "B", count(eval(countfield="C")) AS "C", count(eval(countfield="D")) AS "D", count(eval(countfield="E")) as "E" span=1d