Monitoring Splunk

Which is more efficient - filldown or streamstats

simpkins1958
Contributor
... | sort _time | filldown l_lat l_lon by UID | table _time UID w_tbys w_tbyr l_lat l_lon 

or

... | sort _time | streamstats last(l_lat) as lastLat last(l_lon) as lastLon by UID | table _time UID w_tbys w_tbyr l_lat lastLat l_lon lastLon
0 Karma

RR5027153
New Member

filldown does not support "by" argument so if you need "by" arguments , filldown is not an right option for you . check here https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Filldown

0 Karma

MuS
SplunkTrust
SplunkTrust

Run both searches on your system searching your events over the same time range and check the job inspector for each search and you will get the answer which one will perform best for you in your environment.

woodcock
Esteemed Legend

What @MuS said (he beat me to it).

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...