Splunk Search

How do I improve the performance of my current search?

Rzwells2950
New Member

After jumping through a few loops the get my three searches to work together, I got it to work. But now I need to find a way to make it run faster. After a few hours of running it went through 330 million files and was not even a 1/3 of the way done. I plan on putting this in a bar graph and a pie chart. can anyone help?

eventtype=egress_email Email_Address=* File_Type=*| top limit=20 File_Type   | addtotals row=f col=t labelfield=File_Type label=Email| search File_Type=Email count=* |fields - percent| append [ search eventtype=egress_ntu Operation="Network Transfer Upload" sourcetype="digitalguardian:events" File_Type=* | top File_Type   | addtotals row=f col=t labelfield=File_Type label=Upload | search File_Type=Upload count=* |fields - percent] | append [search eventtype=egress_removable Was_Removable=True File_Type=*| top limit=20 File_Type   | addtotals row=f col=t labelfield=File_Type label=Removable   | search File_Type=Removable count=* |fields - percent]
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

(eventtype=egress_email Email_Address=* ) OR (eventtype=egress_ntu Operation="Network Transfer Upload" sourcetype="digitalguardian:events" ) OR (eventtype=egress_removable Was_Removable=True )  File_Type=* 
| stats count by eventtype File_Type | sort eventtype -count | streamstats count as rank by eventtype | where (eventtype="egress_ntu" AND rank>11) OR ( (eventtype="egress_email" OR eventtype="egress_removable") AND rank>21) | appendpipe [| stats sum(count) as count by eventtype | eval File_Type=case( eventtype="egress_ntu", "Upload", eventtype="egress_email","Email",1=1,"Removable") | eval rank=21] | sort eventtype rank | fields - rank eventtype

Update
I missed the filters in previous attempt. Give this a try.

(eventtype=egress_email Email_Address=* ) OR (eventtype=egress_ntu Operation="Network Transfer Upload" sourcetype="digitalguardian:events" ) OR (eventtype=egress_removable Was_Removable=True )  File_Type=* 
| stats count by eventtype File_Type | sort eventtype -count | streamstats count as rank by eventtype | where (eventtype="egress_ntu" AND rank>11) OR ( (eventtype="egress_email" OR eventtype="egress_removable") AND rank>21) | stats sum(count) as count by eventtype | eval File_Type=case( eventtype="egress_ntu", "Upload", eventtype="egress_email","Email",1=1,"Removable") | fields - eventtype
0 Karma

Rzwells2950
New Member

I believe its faster, but now I am not getting the Statistics break down of the Uplodes, Email and Removable egress Visualizations. Before I had 3 searches that had a single bar graft of each. But now I would like to make them all into one bar graft and make a pie chart as well. Any idea what would be the best plan of action?

0 Karma

Rzwells2950
New Member

I also need to run this search for the last 3 months

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...