https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417424#M120103 <P>Also be aware there are limits on joins. You should try using stats if possible. See the section on limitations: <A href="http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join">http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join</A> and some alternative ways of performing a join in splunk, there are lots of posts on Splunk answers, here is one: <A href="https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html">https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html</A></P> Sat, 06 Oct 2018 19:44:56 GMT Jeremiah 2018-10-06T19:44:56Z https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417422#M120101 <P>Our saved-search is summary-index enabled and is running every 5 minutes.</P> <P>Each event's uniqueness is a combination of 4 fields and thus I'm planning to add a unique identifier before it gets written to the summary-index e.g. <CODE>| eval uniqueId = sha256(field1 . field2 . field3 . field4)</CODE>.</P> <P>One of our use cases is to left-join values from the aforementioned summary index to a lookup table, which already has the same field i.e. <CODE>uniqueId</CODE>. The idea is to join the summary index and the lookup table like our good old SQL baby <CODE>ON uniqueId=uniqueId</CODE>.</P> <P>My question is how much computing power will it cost for the saved search to perform the hash? Will it significantly slow down the summary indexing process?</P> <P>Is it better to do <CODE>| join type=left field1, field2, field3, field4</CODE> rather than <CODE>| join type=left uniqueId</CODE>?</P> <P>Thanks in advance.</P> Fri, 05 Oct 2018 04:34:56 GMT https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417422#M120101 morethanyell 2018-10-05T04:34:56Z https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417423#M120102 <P>try and run the searches and look at the job inspector and see the load of that particular eval</P> Sat, 06 Oct 2018 15:50:39 GMT https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417423#M120102 adonio 2018-10-06T15:50:39Z https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417424#M120103 <P>Also be aware there are limits on joins. You should try using stats if possible. See the section on limitations: <A href="http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join">http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join</A> and some alternative ways of performing a join in splunk, there are lots of posts on Splunk answers, here is one: <A href="https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html">https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html</A></P> Sat, 06 Oct 2018 19:44:56 GMT https://community.splunk.com/t5/Splunk-Search/How-expensive-is-sha256-in-computing-power/m-p/417424#M120103 Jeremiah 2018-10-06T19:44:56Z