How to smoothly query an indexed field extracted and a search extract field

[davidlg]

Hello,

I am using  an extract field at search time called "src_ip".

To optimize search response times, I have create an indexed field extraction called "src_ip-index".

How to "backendly" configure Splunk so end users will query only a single field which use both "src_ip-index" and "src_ip" , but use "src_ip-index" in priority when available due to better performance.

hope it is clear enough.

Best regards,

[PickleRick]

 Creating additional indexed fields has its uses but it also has its drawbacks and very often speedup of your searches can be achieved in various different ways (summary indexing, report acceleration, datamodel acceleration). So defining indexed fields just to make search work faster may in many cases not be the best idea. Often it's enough to search your data properly to get a big increase of efficiency.

Theoretically, you could define a calculated field using coalesce() and returning the indexed value if found (and Splunk migh be able to optimize the search properly) but due to how splunk search works, it might not in some cases give you big search speed improvement.

[davidlg]

Hello,

Thanks for the reply, will try coalesce().

In my case "create additional indexed fields " improves a search speed without giving headache to non regular splunk users.

Apart from the storage, is there any other drawbacks to consider ?

[PickleRick]

Actually, storage is usually not that much of a problem (although it does come with some overhead). It's mostly the losing of flexibility typically associated with Splunk that matters - an indexed field is indexed as is on the indexing pipeline and its value cannot be changed afterwards. Also searching indexed fields is different than "normal" Splunk search and can lead to unexpected results, especially if you don't configure your fields properly in fields.conf.

[isoutamo]

Hi

probably you should look data models and how those can use for get the same or even better search time?

• https://docs.splunk.com/Documentation/CIM/5.3.1/User/Overview
• https://docs.splunk.com/Documentation/Splunk/9.1.2/Knowledge/Aboutdatamodels

There is also some DM trainings on EDU site.

r. Ismo