I don't understand when "search_optimization" will be used.
And like below situation, there is the scene that search doesn't work.
So I want to know when "searchoptimization" was used, and which search "searchoptimization" was used to.
How can I do this?
Are kind of these informations in the internal logs?
@yutaka1005, unless Search Optimization is turned off, it should always be applicable for all searches. However what you should be worried about is whether optimized search is different from original or not. If it is whether it is for better or worse.
Once a search runs you can compare original search with optimized using one of the following options:
Option 1: You can open
Job Inspector and check out the
Search job properties which should list out
Optimized Search as well.
Option 2: Use REST end point **
**Step 1: Run a search with
| addinfo command to get YourSearchID
Step 2: Use the following REST API with YourSearchID fetched in the previous step. Compare the original query with optimized.
| rest /services/search/jobs/<YourSearchID> | table request.custom.search optimizedSearch
PS: Documentation link for REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...
Following is the documentation on Search Optimization. As mentioned under certain circumstances,
noop search_optimization=false would be required when the optimized search does not work as expected compared to the actual search.
Also refer to one of the questions from @martin_mueller on the same topic. You can add in your issue details if it is on similar lines:
@yutaka1005, if this has helped please accept the answer. If not please ask further questions that you may have, community members would surely be able to assist.