Documentation:
3.1.5
This page last updated: 09/24/07 05:09pm
Make SplunkWeb search faster
If you find that your searches are not returning quickly enough, you can make a few changes to Splunk to return results faster in the UI. Here are a few things you can try:
Enable core fields onlyYou can change your searches to use core fields only. Core fields include only host: source: and sourcetype::. If you do not need any additional fields for your searches, turn core fields only on by selecting the Fields drop down menu from any search results page. Check the core only (faster searching) box:
If you want to keep all your search and extracted fields, you can still increase your search time by turning off the Search for related events field action.
If you find that you are not using related events in your searches, you can use this method to vastly increase your search time.
Please note: this configuration still enables both search and extracted fields but does not support related events.
To make changes, edit SPLUNK_HOME/share/splunk/search_oxiclean/static/js/query.js.
Around line 750, you'll see the following three lines:
if (componentClass=="resultsScrollerComponent" && !isReport) {
readLevel = (!isTurboOn && isVanillaSearch) ? 11 : 2;
} Changing the 11 to a 3 will permanently disable the related processing from running, and therefore enable faster search results.
Disable typeaheadTypeahead is supposed to be restricted to your current timerange. Currently, however, this only works with absolute timeranges. If you have large datasets of days, months or years, typeahead can be very slow and unduly load the server.
The short-term fix is to disable typeahead altogether. To affect this change, edit SPLUNK_HOME/share/splunk/search_oxiclean/static/js/typeahead.js
Look for the string TypeAheadQuery.prototype.send. It is the first line of a function that's about 30 lines.
In the middle of this function, you will find the following code:
if (selectionRange.startTime) {
qArgs['startTime'] = selectionRange.startTime.print(window.SEARCH_TERM_TIME_FORMAT);
}
if (selectionRange.endTime) {
qArgs['endTime'] = selectionRange.endTime.print(window.SEARCH_TERM_TIME_FORMAT);
} Insert this new line right after the above block of code:
if (!selectionRange.startTime || !selectionRange.endTime) return false;
That will disable typeahead entirely unless you've clicked a bar in the timeline, or are using custom time.
Comments
No comments have been submitted.