topic Re: Is INDEXED_EXTRACTIONS = json expensive on the indexer? in Getting Data In

Is INDEXED_EXTRACTIONS = json expensive on the indexer?

ddrillic — Tue, 11 Sep 2018 15:14:08 GMT

In What are the requirements for a perfect Splunk JSON document?

We spoke about -

INDEXED_EXTRACTIONS = json
category = Structured

Is INDEXED_EXTRACTIONS = json expensive on the indexer? because I'm being told that we should avoid it due to the load it puts on the indexer...

Re: Is INDEXED_EXTRACTIONS = json expensive on the indexer?

sudosplunk — Tue, 11 Sep 2018 17:12:01 GMT

Hi @ddrillic,

In short yes. Please have a look at this article. This guy did some good case study comparing index-time vs search-time extractions.

https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions

HTH!

Re: Is INDEXED_EXTRACTIONS = json expensive on the indexer?

ddrillic — Tue, 11 Sep 2018 19:19:26 GMT

Very interesting @nittala_surya.

I guess they are saying that -
KV_MODE=JSON on the search heads is equivalent to
INDEXED_EXTRACTIONS=JSON on the indexer side

And the overhead on the SHs is lighter.

Is it right?

Re: Is INDEXED_EXTRACTIONS = json expensive on the indexer?

sudosplunk — Tue, 11 Sep 2018 19:37:59 GMT

Absolutely.

Re: Is INDEXED_EXTRACTIONS = json expensive on the indexer?

ddrillic — Wed, 12 Sep 2018 16:01:51 GMT

Speaking with the sales engineer who explained that in certain cases it can be expensive and in certain cases not. He also said that in case the json document is not valid we can lose data as only the name value pairs are retained and not the raw data. KV_MODE = JSON on the SH and the indexer marks the data as json.