Knowledge Management

Is there any way to do calculated fields before search time?

Engager

I was using calculated fields, but then I started reading the documentation and saw that calculated fields are done during search-time.
https://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/definecalcfields

I'm thinking this doesn't really give me an advantage of having it inside of the search vs outside in a calculated field in terms of performance.

Is there anyway to do the calculated field before search time? or is it only done once during the first initial search?

0 Karma

SplunkTrust
SplunkTrust

The point of a calculated field is not performance, it's keeping complexity out of multiple searches.
While you usually don't gain any performance compared to an inline eval command in your search, you also don't lose any.

By moving your case expression to a calculated field, you enable every searcher to use the result without having to know about how it was computed, without having to compute it themselves in the search, without having to update the expression in dozens of places in case something changed.

Shameless plug: For detailed thoughts on calculated fields' search performance considerations, attend my .conf2016 talk 😄

0 Karma

Revered Legend

Calculated fields can be created during search time only. There is no expression evaluation available at index-time (only regex replacement /extraction is available). What are doing in the calculated field BTW?

0 Karma

Engager

@somesoni2, I'm doing an eval, in particular a case that statement with several match expressions. Besides calculated field is there another way to create a field before search time?

0 Karma

Revered Legend

There are, but as I said earlier, they can't be created using an expression, like eval-case. See more on Indexed-time field extraction here. Please note that they require additional processing time (at index time) and storage on indexers.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Configureindex-timefieldextraction

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!