官术网_书友最值得收藏!

Making searches faster

We have talked about using the index to make searches faster. When starting a new investigation, the following few steps will help you get results faster:

  1. Set the time to the minimum time that you believe will be required to locate relevant events. For a chatty log, this may be as little as a minute. If you don't know when the events occurred, you might search a larger time frame and then zoom in by clicking on the timeline while the search is running.
  2. Specify the index if you have multiple indexes. It's good to get into the habit of starting your queries with the index name. For example, index=myapplicationindex error bob.
  3. Specify other fields that are relevant. The most common fields to specify are sourcetype and host. For example, index=myapplicationindex sourcetype="impl_splunk_gen" error bob. If you find yourself specifying the field source on a regular basis, you could probably benefit from defining more source types. Avoid using the sourcetype field to capture other information, for instance datacenter or environment. You would be better off using a lookup against host or creating another indexed field for those cases.
  4. Add more words from the relevant messages as and when you find them. This can be done simply by clicking on words or field values in events, or field values in the field picker. For example, index=myapplicationindex sourcetype="impl_splunk_gen" error bob authclass OR fooclass.
  5. Expand your time range once you have found the events that you need, and then refine the search further.
  6. Disable Field discovery in earlier versions of Splunk - there was a toggle at the top of the field picker. In version 6.2, the feature is a bit different. You can simply open the field picker and use the Select All Within Filter or Deselect All checkbox to remove any unneeded fields from the list that Splunk will extract. This can greatly improve speed, particularly if your query retrieves a lot of events. Extracting all the fields from events simply takes a lot of computing time, and disabling this option prevents Splunk from doing all that work when not needed. Take a look at the following screenshot:

If the query you are running is taking a long time to run, and you will be running this query on a regular basis—perhaps for an alert or a dashboard—using a summary index may be appropriate. We will discuss this in Chapter 10, Summary Indexes and CSV Files.

主站蜘蛛池模板: 古交市| 清涧县| 芦溪县| 沅江市| 涿州市| 龙里县| 南充市| 荣成市| 来凤县| 营口市| 九龙坡区| 桓台县| 武山县| 上犹县| 买车| 桂阳县| 赤城县| 虎林市| 县级市| 郧西县| 米脂县| 澎湖县| 肇州县| 阜阳市| 兴宁市| 息烽县| 柏乡县| 如东县| 浦城县| 铜山县| 榆树市| 固安县| 湟中县| 兴仁县| 合阳县| 都兰县| 中江县| 汨罗市| 惠水县| 阳泉市| 独山县|