Monitoring Splunk

Does defining an eventtype improve performance?

BradL
Path Finder

Is there a performance difference between searching for this:

index=foo host=XXXX "a text string bar"

vs.
defining an eventtype bar_event:

index=foo "a text string bar"

and then searching for this:

index=foo host=XXXX eventtype=bar_event

?

I'm wondering if the eventtype definition causes the generation of any additional indexing data to speed up the search.

Tags (2)
1 Solution

chanfoli
Builder

I do not believe so since eventtypes are just replacing regular search language, but hey, did you know that you can always use the job inspector to check into such things with your own searches and data? It is a pretty cool tool.

View solution in original post

chanfoli
Builder

I do not believe so since eventtypes are just replacing regular search language, but hey, did you know that you can always use the job inspector to check into such things with your own searches and data? It is a pretty cool tool.

Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...