Relative Content

Tag Archive for splunksplunk-querysplunk-formulasplunk-calculation

Optimizing Splunk Query for Processing Large Number of Entries

I’m trying to parse a file “cached_txids_1week” with around 18,000 entries using Splunk.
I created a cache file in Splunk with the format (release: list of Txids), like a hashmap, for the last 3 months. I wrote a query to read this file for a specific release, retrieve all its Txids, process them in chunks, calculate the average for each chunk, then find the overall average of all chunks, and save the result in a new file for the Splunk dashboard to read instantly.