Splunk Search

Optimizing a search in splunk

gimbil
Explorer

Hi,

I am trying to do a search which basically generates measures based on the value of a field such as X:

search logs|…..| timechart count(eval(X="1" OR X="2")) AS "A",  count(eval(X="1")) AS "B",  count(eval(X="2")) AS "C",  count(eval(X="3")) AS "D", count(eval(X="4" OR X="5" OR X="6")) as "E" span=1d

however, generating results takes for ever. If I remove some of the counts (like the one to generate "E") it becomes much faster. Is there anyway to better optimize this search?

Thanks

0 Karma

ShaneNewman
Motivator

The answer given by somesoni2 will make it more efficient. The other option is to create a summary index, then search the summary index.

mdmaala
Communicator

how to create a summary index and how will I call it in the search bar?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try following

search logs|…..| eval countField=case(X="1" OR X="2","A",X="1","B",X="2","C",X="3","D",X="4" OR X="5" OR X="6","E",1=1,"E") | timechart count(eval(countfield="A"))AS "A", count(countfield="B") AS "B", count(eval(countfield="C")) AS "C", count(eval(countfield="D")) AS "D", count(eval(countfield="E")) as "E" span=1d

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...