Splunk Search

How expensive is sha256() in computing power?


Our saved-search is summary-index enabled and is running every 5 minutes.

Each event's uniqueness is a combination of 4 fields and thus I'm planning to add a unique identifier before it gets written to the summary-index e.g. | eval uniqueId = sha256(field1 . field2 . field3 . field4).

One of our use cases is to left-join values from the aforementioned summary index to a lookup table, which already has the same field i.e. uniqueId. The idea is to join the summary index and the lookup table like our good old SQL baby ON uniqueId=uniqueId.

My question is how much computing power will it cost for the saved search to perform the hash? Will it significantly slow down the summary indexing process?

Is it better to do | join type=left field1, field2, field3, field4 rather than | join type=left uniqueId?

Thanks in advance.

0 Karma


try and run the searches and look at the job inspector and see the load of that particular eval

0 Karma


Also be aware there are limits on joins. You should try using stats if possible. See the section on limitations: http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join and some alternative ways of performing a join in splunk, there are lots of posts on Splunk answers, here is one: https://answers.splunk.com/answers/568177/replace-join-with-stats-to-merge-events-based-on-c-1.html

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!