Splunk Search

How do I optimize my search?

jkalra
Explorer

I have the following search and takes a lot of time to output data. Is there a way to optimize the search?

eventtype=aos_deployment_1_openam_session_start | timechart count as "Auth Start" | appendcols[| search eventtype=aos_deployment_1_openam_session_end | timechart count as "Auth Completion"] | appendcols[| search eventtype=aos_deployment_1_openam_session_failed | timechart count as "Failed Auth"] | fillnull value=0
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

eventtype=aos_deployment_1_openam_session_start OR eventtype=aos_deployment_1_openam_session_end OR eventtype=aos_deployment_1_openam_session_failed | timechart count by eventtype | fillnull value=0
| rename aos_deployment_1_openam_session_start as "Auth Start" aos_deployment_1_openam_session_end as  "Auth Completion" aos_deployment_1_openam_session_failed as "Failed Auth"
| table _time  "Auth Start" "Auth Completion"  "Failed Auth"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

eventtype=aos_deployment_1_openam_session_start OR eventtype=aos_deployment_1_openam_session_end OR eventtype=aos_deployment_1_openam_session_failed | timechart count by eventtype | fillnull value=0
| rename aos_deployment_1_openam_session_start as "Auth Start" aos_deployment_1_openam_session_end as  "Auth Completion" aos_deployment_1_openam_session_failed as "Failed Auth"
| table _time  "Auth Start" "Auth Completion"  "Failed Auth"

jkalra
Explorer

Thanks Somesh.... Unfortunately this takes a lot of time to execute and also there was a correction in timechart count(eventtype).

Could this because my eventtypes are not optimized?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

My bad. The correct timechart command was "timechart count by eventtype".

My experience with eventtype haven't been great as they always slow my queries. What is your eventtype definition? Some time it's better to create a macro with same definition then eventtype.

0 Karma

jkalra
Explorer

Thats a nice pointer.....can you provide a link on how to create a macro?.
This is what my eventtype looks like

index=cams sourcetype=log4j source=*/aos/aos-audit* deployment_id=1 action="AOS-OPENAM-SESSION" status=START

Can we convert this to a macro?

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

sundareshr
Legend

Try this

eventtype=aos_deployment_1_openam_session_start OR eventtype=aos_deployment_1_openam_session_end OR eventtype=aos_deployment_1_openam_session_failed | eval et=split(eventtype, "_") | eval status=mvindex(et, mvcount(et)-1) | stats count by status | rename start AS "Auth Start" end AS "Auth Completion" failed AS "Failed Auth"
0 Karma

jkalra
Explorer

I downvoted this post because sorry, but this does not give me the desired result . the output i need is failed auth , auth start & auth completion. your search gives me the total counts

0 Karma

jkalra
Explorer

This one gives me no output other than the _time. Plus it takes longer than before 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...