Knowledge Management

Slow search for squid for a 30 days report

pinzer
Path Finder

hi all, i have a problem with a squid search, it is very very slow (over 30 minutes to load) the search is this:

sourcetype="squid" | timechart span="1d" sum(size)

the time for the search is 30 days. How can i speed this search?

the extraction field for the size parameter is

(?i)^[^/]*/\d+\s+(?P<size>[^ ]+)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Summary indexing is one way to speed this up. Conceptually, you tell Splunk to pre-compute this data for smaller intervals (say once per day) - and then you use that pre-computed data to complete your intended search faster.

http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Summary indexing is one way to speed this up. Conceptually, you tell Splunk to pre-compute this data for smaller intervals (say once per day) - and then you use that pre-computed data to complete your intended search faster.

http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing

dwaddle
SplunkTrust
SplunkTrust

You can find information on scheduling searches in the Splunk docs at http://www.splunk.com/base/Documentation/latest/User/SchedulingSavedSearches

0 Karma

pinzer
Path Finder

how can i schedule the search every hour?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...