Field extraction efficiency for transaction command ?

[renjujacob88]

HI Splunkers,

We do have proofpoint logs which we are combining based on the common field with the help of transaction command.
Also we don't have proper field extraction in place so we are planning to create one either with splunk extraction options or with manual regex after the transaction command.

Which one will be good/efficient way,

1) combining the common fields with transaction command and then writing regex as a whole
Or 2) Extracting the fields individually with splunk extraction method and then going with transaction

Please advice

[eckolp2003]

Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:

https://splunkbase.splunk.com/app/3727/#/details

Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.

[skalliger]

Hi,

you want to use field extractions before you do your Splunk search with a transaction.
Also, if you have fields already, you can as well use the stats function (or tstats for even faster queries, but no raw data).
Stats should be preferred to transactions, it is more efficient.

Skalli

[JensT · Accepted solution]

Hi,

Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.

Kind regards,
Jens