Splunk Search

Fields vs table vs nothing?


Thought there was an answer on this already but can't find it, but for something like this, which is the most performant and why?

| evals
| fields
| stats

| evals
| stats

| evals
| table
| stats

I would have that just the stats would've been the fastest, but potentially if fields can be done on the indexer that would be faster?


Tags (1)

Esteemed Legend

You should never use table in the middle of any search; always use fields if anything and save table for the very end (or debugging, because it forces your search to switch to the stats tab). If you are immediately pumping the data into stats then there is no reason to do fields because it is an extra pass through all events to add no value (because stats is going to drop all of those fields as part of its work anyway).


The chief distinction between table and fields is that table returns results to the search head whereas 'fields' does not.
Early use of 'fields' can improve performance in events with many fields by reducing the number of fields the query has to process.

If this reply helps you, an upvote would be appreciated.


I also note that with Splunk SDK (Python), at the end of the embedded query, using 'fields' to select the returned fields, it does not work as I desired with all fields returned. But 'table' would result in only the listed fields returned.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...