topic Re: Splunk SPL best practice in Splunk Search

Splunk SPL best practice

sivaranjiniG — Sun, 12 Jul 2020 15:41:53 GMT

Will a parentheses Surrounded SPL queries make any difference?

For Example:
(index IN (“indexA*”,”indexB*”) source=”sourceA”) and index IN (“indexA*”,”indexB*”) source=”sourceA”

this is a big query want to know if adding parentheses make any difference in performance wise ?

Re: Splunk SPL best practice

richgalloway — Sun, 12 Jul 2020 17:28:55 GMT

Yes, parentheses can make a difference, but in the example given they do not.
Examine the job inspector for each search to confirm.

Re: Splunk SPL best practice

adityagupta3010 — Sun, 12 Jul 2020 21:36:41 GMT

Hi there,

To answer your question, the use of paranthesis doesn't affect the performance of your splunk query.

But on the other hand using a "=" instead of the "IN" function will help you; as IN is a function call and splunk processor will always first go to the function definition decode the function then resume the search query.

Re: Splunk SPL best practice

sivaranjiniG — Mon, 13 Jul 2020 04:41:13 GMT

I checked job Inspect there is difference in seconds..as i said its a big query it may impact performance

Thanks for suggesting me to check job inspect

Re: Splunk SPL best practice

sivaranjiniG — Mon, 13 Jul 2020 04:46:14 GMT

Hi,
I am not sure how to use multiple indexes without using IN in the query..i dont want to use OR as it takes only one index.i want to use 2 indexes

Can you help?

Re: Splunk SPL best practice

richgalloway — Mon, 13 Jul 2020 12:42:54 GMT

The IN operator is translated into ORs before the query executes. So

index IN ("indexA*","indexB*")

becomes

index "indexA*" OR index= "indexB*"