https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39212#M8939 <P>We have a search that is spending most of its time in command.search.kv. If we give it a search which doesn't need any fields, like:</P> <PRE><CODE>index=myindex sourcetype=mytype | stats count </CODE></PRE> <P>it takes 1.8 seconds to count the 104,000 events (that alone seems high).</P> <P>If instead we give it any search which would cause it to extract fields, e.g.:</P> <PRE><CODE>index=myindex sourcetype=mytype myfield=val1 | stats count </CODE></PRE> <P>then the time jumps up to 9 seconds, almost all of which is in command.search.kv.</P> <P>We have no custom field extractions, field transformations, field aliases or tags. Each data item does have 101 fields, but the search in question really only needs 8 of them. Is there any way to speed things up? For example, is there a way to tell Splunk to turn off all of the automatic field extractions and have it use only some user defined ones? Alternatively, is there any way to debug what's happening during command.search.kv?</P> Mon, 20 May 2013 01:41:21 GMT rettops 2013-05-20T01:41:21Z https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39212#M8939 <P>We have a search that is spending most of its time in command.search.kv. If we give it a search which doesn't need any fields, like:</P> <PRE><CODE>index=myindex sourcetype=mytype | stats count </CODE></PRE> <P>it takes 1.8 seconds to count the 104,000 events (that alone seems high).</P> <P>If instead we give it any search which would cause it to extract fields, e.g.:</P> <PRE><CODE>index=myindex sourcetype=mytype myfield=val1 | stats count </CODE></PRE> <P>then the time jumps up to 9 seconds, almost all of which is in command.search.kv.</P> <P>We have no custom field extractions, field transformations, field aliases or tags. Each data item does have 101 fields, but the search in question really only needs 8 of them. Is there any way to speed things up? For example, is there a way to tell Splunk to turn off all of the automatic field extractions and have it use only some user defined ones? Alternatively, is there any way to debug what's happening during command.search.kv?</P> Mon, 20 May 2013 01:41:21 GMT https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39212#M8939 rettops 2013-05-20T01:41:21Z https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39213#M8940 <P>I forgot to mention - the 9 seconds is in 'fast' mode search. In verbose mode it jumps to 18 seconds.</P> Mon, 20 May 2013 02:37:12 GMT https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39213#M8940 rettops 2013-05-20T02:37:12Z https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39214#M8941 <P>You can set KV_MODE to none in props.conf to turn off automatic extraction of key-value pairs.</P> Mon, 20 May 2013 07:31:34 GMT https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39214#M8941 martin_mueller 2013-05-20T07:31:34Z https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39215#M8942 <P>Extractions only happen for fields needed by the search.</P> Mon, 29 Oct 2018 15:03:43 GMT https://community.splunk.com/t5/Splunk-Search/command-search-kv-performance/m-p/39215#M8942 landen99 2018-10-29T15:03:43Z