Hello Fellow Splunkers,
I'm busy with improving a search:
The original search:
“index=powermonitoring source=dashboard_loadtimes* earliest=-30d searchDurationSecs>0 | rename appName as app dashboardName as view | search app!="thisdoesnothing" view!="thisdoesnothing" app!="SA-Removed" AND app!="SA-ldapsearch" AND app!="ita_infobutton" AND app!="heatmap_app" AND app!="launcher" AND app!="timeline_app" AND app!="system" AND app!="splunk_instrumentation" AND app!="splunk_archiver" AND app!="status_indicator_app" AND app!="Splunk_for_Exchange" AND view!=flashtimeline AND view!=landing_page AND view!="SEI_start" AND view!="SEI-EUVLoadAVG" AND view!="SEI-EUVLoadAVG-SD" AND view!="job_manager" AND view!="firewall_blocked" | eval cluster=upper("ops") | where shcluster=cluster | eventstats count as "min_visits" by view | search min_visits >= 3 | eventstats median(searchDurationSecs) as "loadtime" by view | dedup view | sort loadtime | tail 2 | tail 1 | table loadtime view app”
My search:
index=powermonitoring source=dashboard_loadtimes* earliest=-30d searchDurationSecs>0
| search appName!="thisdoesnothing" dashboardName!="thisdoesnothing" appName!="SA-Removed" AND appName!="SA-ldapsearch" AND appName!="ita_infobutton" AND appName!="heatmap_app" AND appName!="launcher" AND appName!="timeline_app" AND appName!="system" AND appName!="splunk_instrumentation" AND appName!="splunk_archiver" AND appName!="status_indicator_app" AND appName!="Splunk_for_Exchange" AND dashboardName!=flashtimeline AND dashboardName!=landing_page AND dashboardName!="SEI_start" AND dashboardName!="SEI-EUVLoadAVG" AND dashboardName!="SEI-EUVLoadAVG-SD" AND dashboardName!="job_manager" AND dashboardName!="firewall_blocked"
| eval cluster=upper("ops")
| where shcluster=cluster
| eventstats count as "min_visits" median(searchDurationSecs) as "loadtime" by dashboardName
| search min_visits >= 3
| dedup dashboardName
| sort loadtime
| tail 1
| rename appName as app, dashboardName as view
| table loadtime view appName
The results are different. I need the results of the original search, but the search itself has to be improved.
Please help.
... View more