Splunk Search

Based on the search time which is best, stats or transaction?

Ramana246
Explorer

based on the search time which is best, stats or transaction.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Ramana246,

use stats all the times you can,

in other words, you have to use transaction (that's very slow command) only if you have to use a condition as startswith or endwith.

Ciao.

Giuseppe

0 Karma

yuanliu
SplunkTrust
SplunkTrust

stats, hands down.

Ramana246
Explorer

Thanks 

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...