Splunk Search

Help understanding the commands - Search vs Where after first pipe

Kukkadapu
Path Finder

Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?

Thanks

0 Karma
1 Solution

masonmorales
Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

View solution in original post

jplumsdaine22
Influencer

Kukkadapu
Path Finder

Thanks for your time and links jplumsdaine22 :).

0 Karma

masonmorales
Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

martin_mueller
SplunkTrust
SplunkTrust

Additionally, move as much filtering as you can into search before the first pipe.

(Exception: Report Acceleration / Postprocessing / etc. scenarios where you pre-compute a data cube style thingy and feed many things off it, here filtering late can make sense)

Kukkadapu
Path Finder

That makes sense. Thanks for your time 🙂

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...