Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is outputlookup just really slow?

$
0
0
I am trying to summarize data for all time from an accelerated report. My approach is to do this a month at a time going backwards in time until I have everything and then I will schedule a daily job. My accelerated report is working fine, returning month to date data (9700 results) in 4-6s but when I tried tacking on an outputlookup to the accelerated report query, the job took 13 minutes the difference seems extreme for writing 9700 results to a file. is outputlookup just really that slow? Or does this indicate some kind of other resource issue? I ran the accerated report for last month and it ran in 4.5s (10800 results) in this case I added the existing lookup, resummarize across the two result sets, and then wrote that to the lookup file. This took 21 minutes. I added pictures of the inspector for the first run, plain acellerated report vs with outputlookup in case that helps to explain the difference. ![alt text][1] [1]: /storage/temp/217895-investigator-outputlookup.jpg

Viewing all articles
Browse latest Browse all 47296

Trending Articles