Splunk Search

When should I use search_optimization?

yutaka1005
Builder

I don't understand when "search_optimization" will be used.
And like below situation, there is the scene that search doesn't work.

Issue number:SPL-145968
https://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/KnownIssues

So I want to know when "search_optimization" was used, and which search "search_optimization" was used to.
How can I do this?

Are kind of these informations in the internal logs?

0 Karma
1 Solution

niketn
Legend

@yutaka1005, unless Search Optimization is turned off, it should always be applicable for all searches. However what you should be worried about is whether optimized search is different from original or not. If it is whether it is for better or worse.

Once a search runs you can compare original search with optimized using one of the following options:

Option 1: You can open Job Inspector and check out the Search job properties which should list out Optimized Search as well.

Option 2: Use REST end point **
**Step 1
: Run a search with | addinfo command to get YourSearchID
Step 2: Use the following REST API with YourSearchID fetched in the previous step. Compare the original query with optimized.

|  rest /services/search/jobs/<YourSearchID>
|  table request.custom.search optimizedSearch

PS: Documentation link for REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

Following is the documentation on Search Optimization. As mentioned under certain circumstances, noop search_optimization=false would be required when the optimized search does not work as expected compared to the actual search.
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...

Also refer to one of the questions from @martin_mueller on the same topic. You can add in your issue details if it is on similar lines:
https://answers.splunk.com/answers/465888/if-youre-running-650-you-should-disable-search-opt.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@yutaka1005, unless Search Optimization is turned off, it should always be applicable for all searches. However what you should be worried about is whether optimized search is different from original or not. If it is whether it is for better or worse.

Once a search runs you can compare original search with optimized using one of the following options:

Option 1: You can open Job Inspector and check out the Search job properties which should list out Optimized Search as well.

Option 2: Use REST end point **
**Step 1
: Run a search with | addinfo command to get YourSearchID
Step 2: Use the following REST API with YourSearchID fetched in the previous step. Compare the original query with optimized.

|  rest /services/search/jobs/<YourSearchID>
|  table request.custom.search optimizedSearch

PS: Documentation link for REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

Following is the documentation on Search Optimization. As mentioned under certain circumstances, noop search_optimization=false would be required when the optimized search does not work as expected compared to the actual search.
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...

Also refer to one of the questions from @martin_mueller on the same topic. You can add in your issue details if it is on similar lines:
https://answers.splunk.com/answers/465888/if-youre-running-650-you-should-disable-search-opt.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

yutaka1005
Builder

Thank you for comment.

It was very helpful that you told me how to figure out information of Optimized Search.

0 Karma

niketn
Legend

@yutaka1005, if this has helped please accept the answer. If not please ask further questions that you may have, community members would surely be able to assist.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...