Splunk Search

Help understanding the commands - Search vs Where after first pipe

Path Finder

Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?

Thanks

0 Karma
1 Solution

Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

View solution in original post

Influencer

Path Finder

Thanks for your time and links jplumsdaine22 :).

0 Karma

Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

View solution in original post

SplunkTrust
SplunkTrust

Additionally, move as much filtering as you can into search before the first pipe.

(Exception: Report Acceleration / Postprocessing / etc. scenarios where you pre-compute a data cube style thingy and feed many things off it, here filtering late can make sense)

Path Finder

That makes sense. Thanks for your time 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!