topic Re: Performance of EXTRACT- vs REPORT- for same regex in Splunk Search

Performance of EXTRACT- vs REPORT- for same regex

Jason — Tue, 25 Jan 2011 07:39:10 GMT

Is there any difference in performance when using

props.conf
EXTRACT-name1 = long (?<field1>regex) with lots of (?<field2>capture groups)

versus

props.conf
REPORT-name2 = transform_name

transforms.conf
[transform_name]
REGEX = long (regex) with lots of (capture groups)
FORMAT = field1::$1 field2::$2

Re: Performance of EXTRACT- vs REPORT- for same regex

araitz — Tue, 25 Jan 2011 09:08:18 GMT

Since they are both extracted by the same regex processor at search time, my educated guess would be no.

Due to tradition, style, and readability, I personally tend to use the transforms.conf specification.

Re: Performance of EXTRACT- vs REPORT- for same regex

Jason — Wed, 26 Jan 2011 00:30:17 GMT

Thanks - so do I. But I was working up a regex on the search bar with rex yesterday and tossed it right in an EXTRACT - so I was wondering.

Re: Performance of EXTRACT- vs REPORT- for same regex

Jason — Wed, 26 Jan 2011 02:01:09 GMT

REPORT also allows you to apply the same regex easily to multiple data types without having multiple copies of the regex around - another reason why I use it.