Monitoring Splunk

Does defining an eventtype improve performance?

BradL
Path Finder

Is there a performance difference between searching for this:

index=foo host=XXXX "a text string bar"

vs.
defining an eventtype bar_event:

index=foo "a text string bar"

and then searching for this:

index=foo host=XXXX eventtype=bar_event

?

I'm wondering if the eventtype definition causes the generation of any additional indexing data to speed up the search.

Tags (2)
1 Solution

chanfoli
Builder

I do not believe so since eventtypes are just replacing regular search language, but hey, did you know that you can always use the job inspector to check into such things with your own searches and data? It is a pretty cool tool.

View solution in original post

chanfoli
Builder

I do not believe so since eventtypes are just replacing regular search language, but hey, did you know that you can always use the job inspector to check into such things with your own searches and data? It is a pretty cool tool.

View solution in original post