Splunk Search

How do I optimize the performance of my search that is currently using a different time range per sourcetype?

McJansen
Engager

Hi,

I have a performance issue concerning multiple time ranges in 1 search.
The search string is as follows:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 hoursago=24])

I choose for the timerangepicker the value: last 3 months.

Now this search will take ages.
The first part of the search isn't the problem, but the second one is.
It should be clear that I want all records from the first part and only the records from the last 24 hours from the last part.
The search above provide me with these, but the search takes ages.

My question is: isn't there a way to make this search faster?
I can't join because of the number of records (over 72 million) .

Thanx in advance!!

0 Karma
1 Solution

NOUMSSI
Builder

Hi,

Try this for your the second one:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])

View solution in original post

0 Karma

NOUMSSI
Builder

Hi,

Try this for your the second one:

(index=[index1] sourcetype=[sourcetype1]) OR (index=[index2] sourcetype=[sourcetype2 earliest=-24h latest=now])
0 Karma

McJansen
Engager

Sometimes I feel stupid! 😉

Thanx!!!!

0 Karma

NOUMSSI
Builder

Ok! please dont forget to vote me

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...