Splunk Search

Acceleration not working...

dcasey
Engager

Struggling with this query in Splunk ES. The results come back fine but take a long time to generate. Tried to accelerate it but got an error stating that it can't be accelerated. I have many accelerated queries that use the timechart command (a requirement for accelerated reports), but they were all on Splunk base. First time trying to do this on the ES installation. Any ideas on what is preventing it from being accelerated?

FYI - The query is intended to look back 12 months (year to date) and display a vertical graph of all events closed by severity in ES.

notable | search status_label="Closed" OR status_label="Resolved" | eval severity_status=severity.":".status_label | fillnull value="unknown" | timechart span=1mon count by severity_status | rename "informational:Closed" AS "Informational","low:Closed" AS "Low","medium:Closed" AS "Medium","high:Closed" AS "High","critical:Closed" AS "Critical"

Tags (2)

xwang_splunk
Splunk Employee
Splunk Employee

either find a way to remove your |fillnull pipe, or adding a list of fields to your |fillnull pipe. Then the check can pass.

0 Karma

sowings
Splunk Employee
Splunk Employee

In short, because the acceleration of searches look to reduce the overall result set, and certain search commands disqualify a search for acceleration. In this case, there's a lot packed into that `notable` macro which is doing a lot of per-event filtration / eval, etc. Because of all of that per event manipulation, the parser knows that it can't effectively accelerate the search.

Further, the place that gets you to having the "status_label" field is also jammed with macro goodness. In particular we have to consult several lookups to ascertain the current state of the event; this isn't indexed data at this point, so it's also not a candidate for acceleration.

There may be a way, however, to short-circuit some of the parts of that query to get you to what you want more directly. I'll do some fiddling on my local instance and see what I can come up with.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...