Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Is INDEXED_EXTRACTIONS = json expensive on the ind...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In What are the requirements for a perfect Splunk JSON document?
We spoke about -
INDEXED_EXTRACTIONS = json
category = Structured
Is INDEXED_EXTRACTIONS = json expensive on the indexer? because I'm being told that we should avoid it due to the load it puts on the indexer...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @ddrillic,
In short yes. Please have a look at this article. This guy did some good case study comparing index-time vs search-time extractions.
https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions
HTH!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @ddrillic,
In short yes. Please have a look at this article. This guy did some good case study comparing index-time vs search-time extractions.
https://www.hurricanelabs.com/blog/splunk-case-study-indexed-extractions-vs-search-time-extractions
HTH!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Very interesting @nittala_surya.
I guess they are saying that -
KV_MODE=JSON on the search heads is equivalent to
INDEXED_EXTRACTIONS=JSON on the indexer side
And the overhead on the SHs is lighter.
Is it right?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Absolutely.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Speaking with the sales engineer who explained that in certain cases it can be expensive and in certain cases not. He also said that in case the json document is not valid we can lose data as only the name value pairs are retained and not the raw data. KV_MODE = JSON on the SH and the indexer marks the data as json.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
