Reporting

report acceleration - memory usage

lukasz92
Communicator

Hi,

I am looking for answer to two questions:

1) How command | savedsearch provides results if the report has time input, and I select wider range in my query?
This report defaults to Last 24 hours with search, and has 3 months accelerated.

2) How to debug extremly high memory usage (over 12 GB) on searchhead if I start a query and run it for last 30 days?

Report search looks like: index="wineventlog" host=* (EventID=4688 OR EventID=861) NewProcessName=* SubjectUserName=* | rename SubjectUserSid as user, NewProcessName as process | lookup whitelist_win process | fillnull active | stats sparkline(count) AS timeline, max(active) AS active by host, user, process
My search which use this report is | savedsearch "WinRunningApps"

This lookup is small, and has a wildcard matching.

0 Karma

cmerriman
Super Champion

for the time range portion, if you select a new time range in the time picker, it overrides the range saved in the saved search. you can see that under Time ranges in the documentation
https://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/Savedsearch

one thing that might help make this more efficient is to aggregate the results before the lookup, if possible. you're joining your lookup to every single event, if you could narrow the number of rows it had to join to, that might help.

0 Karma

niketn
Legend

To add on to cmerriman's comment, following is the documentation on performing stats first and then lookup: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_sea...

Following rename can be moved to later part of the query (after stats), possibly the final command for formatting.

| rename SubjectUserSid as user, NewProcessName as process

PS: You do not need to match field names to perform lookup:

| lookup whitelist_win process  AS NewProcessName
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...