How splunk search work

indeed_2000 — Thu, 09 Dec 2021 04:15:30 GMT

I have 4 huge log file that ingest into the Splunk

File1

File2

File3

File4

Now i want to know when i search specific string that only exist in the file1, what will be happen?

What happens in the search process, for example if i exclude file2,3,4, does it effect in my search performance? Or Splunk automatically ignore them because they have not contain that string.

Any idea?

Thanks

Re: How splunk search work

isoutamo — Thu, 09 Dec 2021 08:15:38 GMT

You should read this e.g. from https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutoptimization

There are lot of information on splunk's own documentation and also on .conf presentations e.g. https://conf.splunk.com/files/2019/slides/FN1407.pdf just search with "search optimisation" from conf online page.

Shortly to your question.

If those are same file but different occurrences then bot source and sourcetype will be same. But if those are different then you should use "source=.../File1 sourcetype=st_file1" on your SPL to restrict the search to only this file and then it will be more efficiently.

In generally splunk is not good for exclude things, it's much better to include (as you can see on docs). This affects also to performance. So try to use " a OR b OR c" instead of "NOT d".

Here is one more explanation, maybe little bit more detailed than what you are looking? https://community.splunk.com/t5/Splunk-Search/Where-can-I-find-a-detailed-explanation-on-how-Splunk-search/m-p/110116

Unfortunately I couldn't found that Splunk_and_MapReduce.pdf anymore from splunk.com, but some copies seems to be available somewhere else. Does anyone known if this is still available also on splunk.com?

r. Ismo

topic Re: How splunk search work in Splunk Search

How splunk search work

Re: How splunk search work