SPL
Datamodel Search Performance
Description
See how well your DM searches are running.
Run this search using the Line Chart visualization:
4 0
index=_internal sourcetype=scheduler component=SavedSplunker ACCELERATE NOT skipped run_time=*
| rex field=savedsearch_id "ACCELERATE_(?:[A-F0-9\-]{36}_)?(?<acceleration>.*?)_ACCELERATE"
| timechart span=5m max(run_time) AS run_time by acceleration
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.