https://community.splunk.com/t5/Knowledge-Management/performance-considerations-macros-vs-eventtypes-vs-data-models/m-p/127439#M1285 <P>Hello</P> <P>From a performace point of view:</P> <OL> <LI>Macros: doesn't produce any performance improvements, they are just for code reusing and to keeps things simple an easy.</LI> <LI>Event-Types: they are not subsearaches, and have some kind of impact on performance but its not a big deal</LI> <LI>DataModels: If you use data model acceleration you will get a big performance improvement. So this will be your choice</LI> </OL> <P>Regards</P> Wed, 27 May 2015 07:00:57 GMT gfuente 2015-05-27T07:00:57Z https://community.splunk.com/t5/Knowledge-Management/performance-considerations-macros-vs-eventtypes-vs-data-models/m-p/127438#M1284 <P>Hi all,</P> <P>are there any experiences out there regarding performance-comparison of macros, eventtypes and data-models?</P> <P>We're currently planing a rebuild of a huge Splunk app which should get more flexible to be run within other landscapes. Therefore we'd like to build some kind of sublayer between the individual Splunk landscapes and the upper Splunk App-Part.<BR /> In Enterprise Security App this has been done using eventtypes.</P> <P>I'm currently unsure if eventtypes are the best solution.<BR /> From my understanding eventtypes are some kind of "subsearches" - based on the behaviour of Splunk, this means a second search-thread is being initialized for each search eventtype-definition. Is this assumption correct?<BR /> How do macros behave in this situation? Only replacing parts of the search string, and no additional search-thread?<BR /> At least how do data-models fit in these thoughts?</P> <P>How is the experience in performance and maintaining a huge set of macros, eventtypes or data-models?<BR /> Would love to hear some real-life experience.<BR /> Thank you all</P> <P>Regards,<BR /> Christian</P> Tue, 26 May 2015 14:16:56 GMT https://community.splunk.com/t5/Knowledge-Management/performance-considerations-macros-vs-eventtypes-vs-data-models/m-p/127438#M1284 christian_l 2015-05-26T14:16:56Z https://community.splunk.com/t5/Knowledge-Management/performance-considerations-macros-vs-eventtypes-vs-data-models/m-p/127439#M1285 <P>Hello</P> <P>From a performace point of view:</P> <OL> <LI>Macros: doesn't produce any performance improvements, they are just for code reusing and to keeps things simple an easy.</LI> <LI>Event-Types: they are not subsearaches, and have some kind of impact on performance but its not a big deal</LI> <LI>DataModels: If you use data model acceleration you will get a big performance improvement. So this will be your choice</LI> </OL> <P>Regards</P> Wed, 27 May 2015 07:00:57 GMT https://community.splunk.com/t5/Knowledge-Management/performance-considerations-macros-vs-eventtypes-vs-data-models/m-p/127439#M1285 gfuente 2015-05-27T07:00:57Z