Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?
Thanks
where
is used strictly for comparison operations (e.g. fieldX!=fieldY
, numeric_field>500
, etc.), whereas search
is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.
).
I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.
https://answers.splunk.com/answers/389111/help-understanding-search-command-where.html
TLDR; Use search if you can, use where if you need to do something complicated.
See also: http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Where
Thanks for your time and links jplumsdaine22 :).
where
is used strictly for comparison operations (e.g. fieldX!=fieldY
, numeric_field>500
, etc.), whereas search
is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.
).
I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.
Additionally, move as much filtering as you can into search
before the first pipe.
(Exception: Report Acceleration / Postprocessing / etc. scenarios where you pre-compute a data cube style thingy and feed many things off it, here filtering late can make sense)
That makes sense. Thanks for your time 🙂