https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349699#M103516 <P>I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other <CODE>evals</CODE> to be "over there".</P> Mon, 19 Jun 2017 13:45:01 GMT woodcock 2017-06-19T13:45:01Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349695#M103512 <P>Hi,</P> <P>I did not know that it is possible:</P> <PRE><CODE>| makeresults | eval fieldA=123, fieldB=456, fieldC=789 </CODE></PRE> <P>I assume that this is better for search performance than </P> <PRE><CODE>| makeresults | eval fieldA=123 | eval fieldB=456 | eval fieldC=789 </CODE></PRE> <P>Is the first example a feature or an unsupported hack that should not be used? I've never seen it before.</P> <P>Cheers</P> Mon, 19 Jun 2017 13:21:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349695#M103512 HeinzWaescher 2017-06-19T13:21:37Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349696#M103513 <P>The first example was supported starting in version 6.4 of Splunk.</P> <P>I have never heard of there being a performance gain by using the first method over the second method, so I always stick to the second method for backwards compatibility and readability. </P> Mon, 19 Jun 2017 13:24:18 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349696#M103513 rjthibod 2017-06-19T13:24:18Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349697#M103514 <P>though, if you do have a lot of evals that are doing the same thing, i believe that <CODE>foreach</CODE> has a performance gain.</P> Mon, 19 Jun 2017 13:44:36 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349697#M103514 cmerriman 2017-06-19T13:44:36Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349698#M103515 <P>I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other <CODE>evals</CODE> to be "over there".</P> Mon, 19 Jun 2017 13:45:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349698#M103515 woodcock 2017-06-19T13:45:01Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349699#M103516 <P>I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other <CODE>evals</CODE> to be "over there".</P> Mon, 19 Jun 2017 13:45:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349699#M103516 woodcock 2017-06-19T13:45:01Z https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349700#M103517 <P>Readability is definitely the point why I would to stick to the second method as well. So I'm happy that there is no performance boost of the the other approach <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thanks</P> Tue, 20 Jun 2017 11:37:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-the-usage-of-multiple-eval-calculations-in-one-pipe-a-feature/m-p/349700#M103517 HeinzWaescher 2017-06-20T11:37:37Z