Splunk Search
Highlighted

Dedup performance 1 field vs multiple fields vs concatenated field

Explorer

Which one would be faster or better in general:

  1. | dedup fieldA fieldB --> I would assume that Splunk does a concatenation in the background
  2. | eval fieldAB = fieldA.fieldB | dedup fieldAB
0 Karma
Highlighted

Re: Dedup performance 1 field vs multiple fields vs concatenated field

Legend

Hi wfskmoney,
I didn't found great differences between the methods (a few hundredths of a second):
scan ot 700,000 events in 8.568 s. in the first case and 8.529 s. in thesecond case.

Bye.
Giuseppe

View solution in original post

0 Karma