I am getting events like _time,boxid,MemoryUsage(bytes),filed1,field2,..
I need to run the search something like
...|spath|rename BOXID as ID,MU as mu|eval mu1=round((mu/1024),2)|timechart limit=0 first(mu1) by ID
for last 7 days or more this chart take so much time to load. Can I calculate mu1 (memory usage in mb) and write the value to splunk in advance so that at the time of chart loading, I just read the value and display.
Please suggest.
Thanks,
Disha
Well, yes, of course.
Have a look at Accelerated Searches or Summary Indexing.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutsummaryindexing
Just saving the results of the calculation round((mu/1024),2)
won't improve performance significantly.
/K