topic Re: Why does the table command in Splunk cause performance degradation? in Splunk Search

Why does the table command in Splunk cause performance degradation?

splunk_anoosheh — Sun, 13 Aug 2017 06:36:10 GMT

When I use this command ( table ) it runs at a slow speed .... please help me.
Thank you for your answer.

Re: Why does the table command in Splunk cause performance degradation?

richgalloway — Sun, 13 Aug 2017 17:01:10 GMT

Please share your full query. The table command by itself usually is not a performance drag.

Re: Why does the table command in Splunk cause performance degradation?

DalJeanis — Mon, 14 Aug 2017 14:16:34 GMT

Oh, this one killed me for a while.

fields is a streaming, distributable command.

table is neither. table, as well as dropping all non-mentioned fields, reformats the data internally, and limits the results as per some system parameters. It may do other stuff, but the bottom line is that table cannot run until all the results are returned to the search head, whereas fields can be run at each indexer.

So, use fields if you are up in the area where you are dealing with streaming distributable commands, and only use table later, after everything is already on the search head.