Hello,
I'm trying to use collect and the subsequent stash file to save time on a large search query. The documentation on collect, http://www.splunk.com/base/Documentation/4.2/SearchReference/Collect, doesn't mention how to then use the stash file.
For example, this is the search query I'm using: index=some_index | regex NAME="(values|that|are|needed)" | regex LV = "(errors|warning|critical)" | collect index="saved_results"
It will then notify that it's saved to the stash file. How can I run a search on the stash?
The data you pipe to the collect
command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:
index=saved_results
let me note that your particular query is probably best improved not by using summary indexing, but instead by using the Splunk index:
index=some_index (NAME=values OR NAME=that OR NAME=are OR NAME=needed) (LV=errors OR LV=warning OR LV=critical)
or
index=some_index (NAME=*values* OR NAME=*that* OR NAME=*are* OR NAME=*needed*) (LV=errors OR LV=warning OR LV=critical)
or whatever is appropriate.
This should run considerably faster than your initial query and is far less complicated than generating a summary.
A summary is really only going to help with post-processing, not retrieval, i.e., if you're doing stats
, chart
or timechart
on results.
Ah, thanks for the tips. It was for a fairly lengthy saved query (about 4800 chars) with a lot of NOT and OR's. I was testing to see if creating a summary index would help with performance.
The data you pipe to the collect
command will be indexed, automatically, in the index you specify. In your example, the following search will show your results:
index=saved_results
Note: You will need to create the respective index, prior to running the collect command.