Splunk Search

Is the search with eval with match in case statement elegible to report acceleration?

aselios
Engager

Hello everyone!!!

This is a search that I was used to setting up a report with acceleration. But in the Report Acceleration Summaries appear as 0% Complete since yesterday. I don't know if this search is elegible to report acceleration? Also any suggestions to speed up the search will be welcome.

Thanks in advance.

sourcetype=f5logs  | eval page_type = case(match(http_uri,"html"),"PDP", match(http_uri,"\/l\/"),"PLP", match(http_uri,"\/api\/(?!user)"),"All API", match(http_uri,"\/api\/user(?!\/placeOrder)"),"User API", match(http_uri,"\/g\/"),"GLP", match(http_uri,"\/c\/"),"Category", match(http_uri,"\.gif|\.jpg|\.js|\.css"),"Assets", match(http_uri,"/api\/user\/placeOrder"),"PlaceOrder", match(http_uri_query,"searchinfo"),"Search", match(http_uri,"\/searchsite\/default\.aspx|\/catalog\.tpl|\^/$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"), "Home", match(http_uri,"^((?!html|\/l\/|\/api\/|\/g\/|\/searchsite\/default\.aspx|/catalog\.tpl|\^/$$|\/g\/|\/c\/|\.gif|\.jpg|\.js|\.css).)*$$") AND match(http_uri_query,"^((?!searchinfo).)*$$"),"Others") | stats count by page_type

alt text

Tags (1)
0 Karma
1 Solution

aselios
Engager

Thanks Martin for clarifying.

I found the problem. !!!
The problem is with regular expression, substituting double $$ with single $ the report accelartion started to work.

Thanks for your help.

View solution in original post

0 Karma

aselios
Engager

Thanks Martin for clarifying.

I found the problem. !!!
The problem is with regular expression, substituting double $$ with single $ the report accelartion started to work.

Thanks for your help.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

eval and match are no problem here, that doesn't stop a search from being accelerate-able.

Looking at your summarization load of basically 1, it appears there has been a summarization search running since you enabled the summary... give it time if you have a huge amount of data in that sourcetype.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...