Splunk Enterprise

Field extraction efficiency for transaction command ?

Path Finder

HI Splunkers,

We do have proofpoint logs which we are combining based on the common field with the help of transaction command.
Also we don't have proper field extraction in place so we are planning to create one either with splunk extraction options or with manual regex after the transaction command.

Which one will be good/efficient way,

1) combining the common fields with transaction command and then writing regex as a whole
Or 2) Extracting the fields individually with splunk extraction method and then going with transaction

Please advice

0 Karma
1 Solution

Communicator

Hi,

Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.

Kind regards,
Jens

View solution in original post

0 Karma

Path Finder

Proofpoint now has a beta app that will allow you report on and visualze your Proofpoint Protection Server and TAP data! Check out the new app here:

https://splunkbase.splunk.com/app/3727/#/details

Be sure to follow the instructions listed in the details to get all the needed TA's etc that the app needs to work correctly.

0 Karma

SplunkTrust
SplunkTrust

Hi,

you want to use field extractions before you do your Splunk search with a transaction.
Also, if you have fields already, you can as well use the stats function (or tstats for even faster queries, but no raw data).
Stats should be preferred to transactions, it is more efficient.

Skalli

0 Karma

Communicator

Hi,

Option #2 is smarter, as you work on the events.
But first I would check if transaction can be replaced by the much faster "stats" command, as its a streaming command.
In combination with #2 you can pre-filter the data and then add the stats.

Kind regards,
Jens

View solution in original post

0 Karma