Splunk Enterprise

Field extraction efficiency for transaction command ?

renjujacob88
Path Finder

HI Splunkers,

We do have proofpoint logs which we are combining based on the common field with the help of transaction command.
Also we don't have proper field extraction in place so we are planning to create one either with splunk extraction options or with manual regex after the transaction command.

Which one will be good/efficient way,

1) combining the common fields with transaction command and then writing regex as a whole
Or 2) Extracting the fields individually with splunk extraction method and then going with transaction

Please advice

0 Karma
1 Solution

JensT
Communicator

Hi,

Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.

Kind regards,
Jens

View solution in original post

0 Karma

eckolp2003
Path Finder

Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:

https://splunkbase.splunk.com/app/3727/#/details

Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.

0 Karma

skalliger
SplunkTrust
SplunkTrust

Hi,

you want to use field extractions before you do your Splunk search with a transaction.
Also, if you have fields already, you can as well use the stats function (or tstats for even faster queries, but no raw data).
Stats should be preferred to transactions, it is more efficient.

Skalli

0 Karma

JensT
Communicator

Hi,

Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.

Kind regards,
Jens

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...