Splunk Search

How to make search faster

kteng2024
Path Finder

Hello,

below is my search . Since i am using join , search is slow . Can i please know if there is a way to increase the speed of the search rather than absolutely specifying the index.

| tstats max(time) as lastReport WHERE splunk_server_group=abc index=*_abc* OR index=main by host | eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") | table LastReported host |join host [search index=_internal hostname=* | stats count by hostname sourceIp| rename hostname as host ]

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @kteng2024

Can you please try this?

| tstats max(_time) as lastReport WHERE splunk_server_group=abc index=abc OR index=main by host 
| eval LastReported=strftime(lastReport,"%m/%d/%y %H:%M:%S") 
| fields LastReported host 
| append 
    [ search index=_internal hostname=* 
    | stats count by hostname sourceIp 
    | rename hostname as host ] | stats values(sourceIp) as sourceIp values(LastReported) as LastReported by host
0 Karma

Elsurion
Communicator

A short win is when you add

| fields hostname, sourceIp

to your search, on my system it gave me about a win of 50% searchtime from 22sec to 11sec over a period of 60mins

Other question is, what are you expecting from your search here? Just a list when a certain host has sent last it's data?

0 Karma

mayurr98
Super Champion

Have you tried doing report acceleration?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...