Splunk Search

Can you help me clean up my search syntax so my results populate faster?

sangs8788
Communicator

The below query is used to return the Error distribution in 3 layers - Application, Dataservice & Queue for a time range two months.
Currently the query takes more than 5 mins to return the result.

index=performance host="prod*"  AND host= "/*web/*" earliest=1500076800  latest=1504915200  | eval layer="Application"| append [search index=performance host="prod*" MQ _raw="/*ERROR/*"  earliest=1500076800  latest=1504915200   | eval layer="Queue"] | append [search index=performance host="prod*" exception="*sql*" sqlserver OR db2   earliest=1500076800  latest=1504915200  | append[search index=de riak sourcetype=kvs_console "\[error\]" host="prod*"   earliest=1500076800  latest=1504915200   ] | append [search index=de host="*prod*" source="*memsql*"  "ERROR"   earliest=1500076800  latest=1504915200   ]|append [search index=de OR index=app sourcetype="solr_log" SEVERE OR ERROR    earliest=1500076800  latest=1504915200  ]|eval layer = "DataService"] |stats count by layer

The query is added a a search panel to dashboard. How can I tune this query so that it gives me results faster?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this ...

earliest=1500076800  latest=1504915200
   (index=performance host="prod*" 
              AND ( ( host= "/*web/*" )  
                 OR ( MQ _raw="/*ERROR/*" )  
                 OR ( exception="*sql*" sqlserver OR db2 ) ) )
OR (index=de  AND ( ( sourcetype=kvs_console "\[error\]" host="prod*") 
                 OR ( host="*prod*" source="*memsql*" "ERROR" )
                 OR ( sourcetype="solr_log" SEVERE OR ERROR ) ) )
OR (index=app sourcetype="solr_log" SEVERE OR ERROR )  

| eval layer=case(index="app" OR index="de","DataService",
                  match(host,"\/.*web\/"),"Application",
                  match(_raw,"MQ") AND match(_raw,"\/.*ERROR\/"),"Queue"
                  true(),"Application")                  
| stats count by layer

Please test thoroughly, this is aircode. Start by testing against a 1 minute slice of data and see if the results are the same as your original. Modify the regex in each match() as needed to correctly identify the source of each event.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...