Knowledge Management

Does the performance of the kvstore lookup definition improve when it filters the original collection?

landen99
Motivator

When a kvstore lookup definition filters a kvstore of 1 million events down to 300k, does performance improve vs using the original kvstore collection unfiltered?

0 Karma
1 Solution

landen99
Motivator

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?splunkbot

filter = <string>
* Filter results from the lookup table before returning data. Create this filter like you would a typical search query using Boolean expressions and/or comparison operators.
* For KV Store lookups, filtering is done when data is initially retrieved to improve performance.
* For CSV lookups, filtering is done in memory.

It looks like performance is improved after the filter is applied on reading the kvstore.

View solution in original post

0 Karma

landen99
Motivator

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf?splunkbot

filter = <string>
* Filter results from the lookup table before returning data. Create this filter like you would a typical search query using Boolean expressions and/or comparison operators.
* For KV Store lookups, filtering is done when data is initially retrieved to improve performance.
* For CSV lookups, filtering is done in memory.

It looks like performance is improved after the filter is applied on reading the kvstore.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!