topic Why are some undefined field searches faster than searches where you define the field and value you are looking for? in Splunk Search

Why are some undefined field searches faster than searches where you define the field and value you are looking for?

packet_hunter — Thu, 28 Sep 2017 14:24:00 GMT

So I noticed that when I run two searches like the following and I am looking for a value, in this case some computer name..

index = indexA  sourcetype=sourcetypeA  "ComputerName"

index = indexA  sourcetype=sourcetypeA  dvc = ComputerName

sometimes the search with the undefined field is faster...

I would think that search time would be faster if you provide more specific details that could be seen in the bloom filters which would speed up the search in general. I am thinking that if the field dvc is not define the search defaults to looking at the raw data.

Can anyone explain what is happening here...

Thank you

Re: Why are some undefined field searches faster than searches where you define the field and value you are looking for?

DalJeanis — Tue, 29 Sep 2020 15:58:56 GMT

Try this and see if it beats them both...

index = indexA  sourcetype=sourcetypeA  "ComputerName" dvc=ComputerName

It is not immediately obvious to me that a bloom filter would always be used if a field name and value is provided. If the above is faster than both the others, then each is having a limiting/accelerating factor.

If the field dvc is not an indexed field, then the field must be extracted at search time before comparison...

Another data question that I'd have if trying to investigate this, is whether your ComputerNames are all word characters, or whether they may be perceived by splunk as multiple tokens - "my_computer_name_is_five_words_long_and_lies_to_people" - which could affect performance.