Splunk Search

Base and post process search

prettysunshinez
Explorer

Can someone help me in understanding the actual use of base and post process searches please.
And I would also like to know if streamstats and eventstats will be recommended as transforming commands in base searches and will there be any performance issue in using them

0 Karma

to4kawa
Ultra Champion
0 Karma

niketn
Legend

To be specific Post Processing Best Practices.

The reason for use of transforming commands in base search is so that you reduce the number of rows by using some aggregation field/s and have base search pull only required (reduced) rows and colums. However, if only eventstats and streamstats are used you will still have original no. or rows and will not be reducing the total number of events.

As far as performance is concerned depends upon factors like:
1. Your Splunk environment specs and configs
2. How much data is getting pulled in your base search.
3. Use loadjob vs. post-processing.
4. Other Acceleration techniques like metrics index, data model acceleration etc.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...