Saving extracted field in Props.conf Vs Using regex extraction directly in search with out saving in props.conf

[Venkat_16]

We had search query were we extract field 1 and field 2 using regular expressions. We have doubt here that which of the dashboards will load faster
case 1:
dashboard whose extracted fields are saved in props.conf

case 2:
dashboard whose extracted fields are directly using them in search query

Please help us in which case works efficient

P.S: In both cases no of events and search queries are same only the fields change

[woodcock · Accepted solution]

It depends. if you did the field extractions at index time ( TRANSFORMS- ) and the extracted fields are used to qualify your base search, then case 1 will be faster. Otherwise it should be the same. In any case, you can easily test this out by using the Job Inspector:

http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ViewsearchjobpropertieswiththeJobInspector

[jmallorquin]

Hi,

Case 1 always will be equal or faster than Case2.
Also with case 1 you have the field able to filter and dont have to make a rex and then filter:

index=a field1=1 

is better than

index=a |rex "(?<field1>\d)" | search field1 = 1

In a distributed environment the extaction of the fileds is pulled to the indexer to optimize the query just to be able to filter in the indexer and don't have to send all to the search head and then filter.