KB 206 - Performance issues when calling landscape_overview_summary_lookup

KB 206 (Splunk): Performance issues when calling landscape_overview_summary_lookup

Description

In the PowerConnect app for Splunk, any use of the landscape_overview_summary_lookup results in severe performance issues.

Cause

The search used to wipe old data from the KV Lookup landscape_overview_summary_lookup does not function properly, resulting in old lookup data being retained longer than the set limit of days stored in the pc_landscape_lookup_delete_days macro.

Resolution

This issue will be fixed in the next release (8.2.0).

1. Go to “Settings > Searches, reports, and alerts”

2. Find the landscape_overview_lookup_clean saved search.

3. Change the final outputlookup command to remove the key_field parameter.
   Before

   CODE

   | outputlookup key_field=key append=false landscape_overview_summary_lookup

   After - The parameter key_field=key has been removed.

   CODE

   | outputlookup append=false landscape_overview_summary_lookup