Question

我最初使用inputlook来获取输出，并且查询正在以秒为单位的几分之一返回输出，但是现在我想使用源作为输入并运行Splunk查询，但是返回输出花费了很多时间。

请提出解决方案以优化输出时间。我正在考虑删除多个追加

index=csvlookups source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_usage.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_dpt_capacity.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_forecasts.csv" 
| eval Date=strftime(strptime(Date,"%m/%d/%Y"),"%Y-%m-%d") 
| sort Date, CLLI 
| rename CLLI as Office 
| search Office="CLGRAB21DS1" 
| stats sum(Usage) as Usage by Office, Date 
| append 
    [ search index=csvlookups source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_usage.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_dpt_capacity.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_forecasts.csv"
    | eval Date=strftime(strptime(Date,"%m/%d/%Y"),"%Y-%m-%d") 
    | reverse 
    | search Office="CLGRAB21DS1" AND Type="SIP PBX" 
    | fields Date NB_RTU 
    | fields - _raw _time ] 
| sort Date 
| fillnull value="CLGRAB21DS1" Office 
| filldown Usage 
| filldown NB_RTU 
| fillnull value=0 Usage 
| eval _time = strptime(Date, "%Y-%m-%d") 
| eval latest_time = if("now" == "now", now(), relative_time(now(), "now")) 
| where ((_time >= relative_time(now(), "-3y@h")) AND (_time <= latest_time)) 
| fields - latest_time Date 
| append 
    [ gentimes start=-1 
    | eval Date=strftime(mvrange(now(),now()+60*60*24*365*3,"1mon"),"%F") 
    | mvexpand Date 
    | fields Date 
    | append 
        [ search index=csvlookups source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_usage.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_dpt_capacity.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_forecasts.csv"
        | rename "Expected Date of Addition" as edate 
        | eval edate=strftime(strptime(edate,"%m/%d/%Y"),"%Y-%m-%d") 
        | rename edate as "Expected Date of Addition" 
        | table Contact Customer "Expected Date of Addition" "Number of Channels" Switch 
        | reverse 
        | search Customer = "Regular Usage" AND Switch = "CLGRAB21DS1" 
        | rename "Number of Channels" as val 
        | return $val ] 
    | reverse 
    | filldown search 
    | rename search as Usage 
    | where Date != "" 
    | reverse 
    | append 
        [ search index=csvlookups source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_usage.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_dpt_capacity.csv" OR source="F:\\SplunkMonitor\\csvlookups\\Core_Network\\lookup_table_sip_pbx_forecasts.csv"
        | rename "Expected Date of Addition" as edate 
        | eval edate=strftime(strptime(edate,"%m/%d/%Y"),"%Y-%m-%d") 
        | rename edate as "Expected Date of Addition" 
        | table Contact Customer "Expected Date of Addition" "Number of Channels" Switch 
        | reverse 
        | search Customer != "Regular Usage" AND Switch = "CLGRAB21DS1" 
        | rename "Expected Date of Addition" as Date 
        | eval _time=strptime(Date, "%Y-%m-%d") 
        | rename "Number of Channels" as Forecast 
        | stats sum(Forecast) as Forecast by Date] 
    | sort Date 
    | rename Switch as Office 
    | eval Forecast1 = if(isnull(Forecast),Usage,Forecast) 
    | fields - Usage Forecast 
    | streamstats sum(Forecast1) as Forecast 
    | fields - Forecast1 
    | eval Date=strptime(Date, "%Y-%m-%d") 
    | eval Date=if(Date < now(), now(), Date) ] 
| filldown Usage 
| filldown Office 
| eval Forecast = Forecast + Usage 
| eval Usage = if(Forecast >= 0,NULL,Usage) 
| eval _time=if(isnull(_time), Date, _time) 
| timechart limit=0 span=1w max(Usage) as Usage, max(NB_RTU) as NB_RTU, max(Forecast) as Forecast by Office 
| rename "NB_RTU: CLGRAB21DS1" as "RTU's Purchased", "Usage: CLGRAB21DS1" as "Usage", "Forecast: CLGRAB21DS1" as "Forecast" 
| filldown "RTU's Purchased" |sort -Forecast

Answer 1

绝对是您不希望经常或在较大时间范围内运行的昂贵查询。在您的第一个附录中，为什么要使用reverse？您是否要获取最新时间和最早时间，这就是为什么使用附加内容？您可以为此使用earliest和latest并消除第一个子搜索。您也可以在第一次搜索时考虑使用eventstats而不是stats，因为您仍将保留原始数据。

您还要对_time进行求和，因此您应该考虑对_time跨度进行分箱（即| bin Date span = 1h）。另外，为什么要使用filldown？我猜您想从不同的行中获取值并需要匹配的行？如果是这样，请为此使用streamstats

Answer 2

如果inputlookup运作良好，则应坚持使用，因为速度不会很快提高。

在不进一步了解数据和最终目标的情况下，很难给出有关查询的具体建议。一般来说：

及早过滤。使基本查询（在第一个“ |”之前）尽可能具体。尽快运行where和search子句。

使用fields代替table。效率更高。

仅在必要时排序。通常，没有必要。

appends越少越好。

splunk查询需要很长时间才能返回值，是否可以消除append

2 个答案: