dbquery run slower after upgrade to splunk 7.0 from 6.4.1

[sylim_splunk]

When comparing runtime of dbquery between splunk 7.0.0 and splunk 6.4.1 the query with 7.0 takes slightly longer than that with 6.4.1. This is not a critical issue but want to know why.

Job Inspector shows like below - as you can find splunk 6.4 has less entries.

From Splunk 7.0.0 + db_connect 3.1.2
Duration (seconds) Component Invocations Input count Output count
1.52 command.dbxquery 1 - 13
0.00 dispatch.check_disk_usage 1 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.68 dispatch.evaluate 1 - -
0.68 dispatch.evaluate.dbxquery 1 - -
0.00 dispatch.evaluate.noop 1 - -
0.68 dispatch.optimize.FinalEval 1 - -
0.65 dispatch.optimize.matchReportAcceleration 1 - -
0.02 dispatch.optimize.optimization 1 - -
0.02 dispatch.optimize.reparse 1 - -
0.73 dispatch.optimize.toJson 1 - -
0.00 dispatch.optimize.toSpl 1 - -
0.01 dispatch.writeStatus 7 - -
0.03 startup.configuration 1 - -
0.06 startup.handoff 1 - -

From Splunk 6.4.1 + 3.1.2
1.88 command.dbxquery 1 - 13
0.00 dispatch.check_disk_usage 1 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.69 dispatch.evaluate 1 - -
0.69 dispatch.evaluate.dbxquery 1 - -
0.01 dispatch.writeStatus 6 - -
0.03 startup.configuration 1 - -
0.06 startup.handoff 1 - -

[sylim_splunk · Accepted solution]

As you can see, those entries are from search optimization feature which was just introduced to 6.5. This just kicks in before it actually start search. The symptom disappears after it disabled as suggested in the link below and performance wise it worked well as expected. It's not something we should disable but it worked for the case.

In $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/limits.conf
[search_optimization]
enabled=false

You can find more information from the documentation;
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...