Monitoring Splunk
Highlighted

Which is more efficient - filldown or streamstats

Contributor
... | sort _time | filldown l_lat l_lon by UID | table _time UID w_tbys w_tbyr l_lat l_lon 

or

... | sort _time | streamstats last(l_lat) as lastLat last(l_lon) as lastLon by UID | table _time UID w_tbys w_tbyr l_lat lastLat l_lon lastLon
0 Karma
Highlighted

Re: Which is more efficient - filldown or streamstats

SplunkTrust
SplunkTrust

Run both searches on your system searching your events over the same time range and check the job inspector for each search and you will get the answer which one will perform best for you in your environment.

Highlighted

Re: Which is more efficient - filldown or streamstats

Esteemed Legend

What @MuS said (he beat me to it).

0 Karma
Highlighted

Re: Which is more efficient - filldown or streamstats

New Member

filldown does not support "by" argument so if you need "by" arguments , filldown is not an right option for you . check here https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Filldown

0 Karma