topic Re: What's the difference between host=abc and host::abc in Splunk Search

What's the difference between host=abc and host::abc

a212830 — Sun, 05 Jun 2016 20:57:00 GMT

Hi,

Was reading some doc (http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Writebettersearches) and it mentions this new way of searching for indexed fields - Specify indexed fields with <field>::<value> - Curious on what this does and how it's better than the traditional method.

Also, is there a way to determine which fields are indexed fields?

Re: What's the difference between host=abc and host::abc

woodcock — Sun, 05 Jun 2016 21:46:58 GMT

There are some very subtle differences but I am not aware of anything that would make one more efficient than the other. The main thing is that the :: syntax is the original syntax that was upgraded to allow for the more obvious = syntax which became the standard. I am surprised to see the older syntax creep back into the documentation. It is probably a documentation oversight and the thrust of this comment in context has has nothing to do with :: vs. = but rather specifying values for fields early in the search, particularly for those that are indexed.

Re: What's the difference between host=abc and host::abc

lstewart_splunk — Tue, 14 Jun 2016 01:40:53 GMT

Here is a link to the list of indexed fields (see the table).
http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Aboutdefaultfields

Re: What's the difference between host=abc and host::abc

cpride_splunk — Tue, 14 Jun 2016 19:32:44 GMT

The :: syntax has some older history that is no longer relevant.

These days the :: syntax is used to indicate in your base search that the field::value pair is indexed. If a field is indexed then it means that we can take advantage of this all the way down to the index level of filtering. Where for search time extracted fields we can only take partial advantage of the index. Fields are indexed they are one of the built in fields as mentioned by @lstewart, you can define fields to be indexed as described here, and finally if you are indexing CSV or JSON as structured data the fields from that data will be indexed as well.

In general because of the additional filtering that can be done with the indexes themselves, if you know that across all your data sources that a field is indexed it is very beneficial to performance to use the '::' syntax, if you use it on a field that is not indexed it can filter out events unexpectedly.

Re: What's the difference between host=abc and host::abc

woodcock — Tue, 14 Jun 2016 19:36:41 GMT

That is fantastic! The documentation definitely needs to make this more clear. I will be using this frequently now.