Getting Data In

Is INDEXED_EXTRACTIONS = json expensive on the indexer?

Ultra Champion

In What are the requirements for a perfect Splunk JSON document?

We spoke about -

INDEXED_EXTRACTIONS = json
category = Structured

Is INDEXED_EXTRACTIONS = json expensive on the indexer? because I'm being told that we should avoid it due to the load it puts on the indexer...

1 Solution

Motivator

Hi @ddrillic,

In short yes. Please have a look at this article. This guy did some good case study comparing index-time vs search-time extractions.

https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions

HTH!

View solution in original post

Motivator

Hi @ddrillic,

In short yes. Please have a look at this article. This guy did some good case study comparing index-time vs search-time extractions.

https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions

HTH!

View solution in original post

Ultra Champion

Very interesting @nittala_surya.

I guess they are saying that -
KV_MODE=JSON on the search heads is equivalent to
INDEXED_EXTRACTIONS=JSON on the indexer side

And the overhead on the SHs is lighter.

Is it right?

0 Karma

Motivator

Absolutely.

0 Karma

Ultra Champion

Speaking with the sales engineer who explained that in certain cases it can be expensive and in certain cases not. He also said that in case the json document is not valid we can lose data as only the name value pairs are retained and not the raw data. KV_MODE = JSON on the SH and the indexer marks the data as json.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!