topic prestats vs stats in Splunk Search

prestats vs stats

rroberts — Thu, 20 Mar 2014 00:07:40 GMT

In $SPLUNK_HOME/var/run/splunk/dispatch/1312323432.11 is see:

03-19-2014 17:02:11.147 INFO  SearchParser - PARSING: litsearch index=_internal source="*license_usage.lo*" type=Usage  | bucket  _time span=10m   | eval  indexer_guid=i   | addinfo  type=count label=prereport_events  | fields  keepcolorder=t "_time" "b" "indexer_guid" "prestats_reserved_*" "psrsvd_*"  | prestats  sum(b) by _time indexer_guid

In the search.log file I see my stats command has been translated to prestats. Why is this?

Re: prestats vs stats

martin_mueller — Fri, 21 Mar 2014 14:59:38 GMT

I'm fairly certain that's related to running as much as possible on the indexers during the map phase, and hence sending as little as possible to the searchhead for the reduce phase. This should not affect your searching... other than through blazing speed of course.

Re: prestats vs stats

rroberts — Fri, 21 Mar 2014 17:41:28 GMT

Thanks, found more details here:

http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf