How expensive is sha256() in computing power?

[morethanyell]

Our saved-search is summary-index enabled and is running every 5 minutes.

Each event's uniqueness is a combination of 4 fields and thus I'm planning to add a unique identifier before it gets written to the summary-index e.g. | eval uniqueId = sha256(field1 . field2 . field3 . field4).

One of our use cases is to left-join values from the aforementioned summary index to a lookup table, which already has the same field i.e. uniqueId. The idea is to join the summary index and the lookup table like our good old SQL baby ON uniqueId=uniqueId.

My question is how much computing power will it cost for the saved search to perform the hash? Will it significantly slow down the summary indexing process?

Is it better to do | join type=left field1, field2, field3, field4 rather than | join type=left uniqueId?

Thanks in advance.

[adonio]

try and run the searches and look at the job inspector and see the load of that particular eval

[Jeremiah]

Also be aware there are limits on joins. You should try using stats if possible. See the section on limitations: http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join and some alternative ways of performing a join in splunk, there are lots of posts on Splunk answers, here is one: https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html