Help understanding the commands - Search vs Where after first pipe

[Kukkadapu]

Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?

Thanks

[jplumsdaine22]

https://answers.splunk.com/answers/389111/help-understanding-search-command-where.html

TLDR; Use search if you can, use where if you need to do something complicated.

See also: http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Where

[Kukkadapu]

Thanks for your time and links jplumsdaine22 :).

[masonmorales · Accepted solution]

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

[martin_mueller]

Additionally, move as much filtering as you can into search before the first pipe.

(Exception: Report Acceleration / Postprocessing / etc. scenarios where you pre-compute a data cube style thingy and feed many things off it, here filtering late can make sense)

[Kukkadapu]

That makes sense. Thanks for your time 🙂