So after figuring out the greatness of Splunk’ing the statistical data from a USP I thought I’d go on to share more of what I’ve come across.

First off to shorten the time frame in which you pull your data so that it’s nearest to real-time as possible. Within your command.txt file, define the longrange value to only be one hour like so:

longrange -000100:

This will definitely help with the amount of time it takes to pull the data.

Now depending on the number of group’s you have defined to export, you can set a lower shortrange value like so:

shortrange -0010:

This will export the data for the last 10 minutes.