In SPL, which one has better performance when used in search queries: "case" or "if"?

[gokadroid]

Hello

In SPL which one has better performance when used in search queries: "case" or "if" ?

[somesoni2]

I don't believe using one over other gives any performance boost. The case is used more for SPL readability.

[skoelpin]

I think they are both very close in terms of performance. One thing I would suggest though is to use your highest match case first followed by the next highest all the way to the lowest being last.. This will boost performance because it will search the most frequent case first and prevent the need from having to iterate through more cases to find the match

[cmerriman]

case is for multiple arguements whereas if for three.

eval field=if(x=1,y,z) >>> if x is 1, then y, otherwise z

eval field=case(x=1,y,x=2,z,1=1,"other") >> if x is 1, then y, if x is 2, then z, if x is anything other 1 or 2, then "other"

the performance of them if they have the same x,y,z argument, is probably the same, but they were created for different reasons.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions

[awmorris · Accepted solution]

They appear virtually identical to me. I just ran both searches on my system (one using CASE and one using IF) and it has a difference of 0.28 seconds searching 1M rows.

index=fictionaldata PRODUCT=VPN| eval locality=case(COUNTRY_NAME == "United States", "Domestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.069 seconds

index=fictionaldata PRODUCT=VPN| eval locality=if(COUNTRY_NAME == "United States", "Domestic","Nondomestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.35 seconds