Splunk Search

How cache fields are computed in index _audit?

Taruchit
Contributor

Hello All,

I need help to understand the cache related fields returned by _audit index for scheduled searches.

duration_command_search_index_bucketcache_miss

duration_command_search_index_bucketcache_hit

duration_command_search_rawdata_bucketcache_hit

duration_command_search_rawdata_bucketcache_miss

invocations_command_search_index_bucketcache_error

invocations_command_search_index_bucketcache_hit

invocations_command_search_index_bucketcache_miss

invocations_command_search_rawdata_bucketcache_error

invocations_command_search_rawdata_bucketcache_hit

invocations_command_search_rawdata_bucketcache_miss

Any information would be very helpful.

Thank you

Taruchit

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...