INFO SearchOperator:kv - Trying to disable extractor name=, INFO SearchOperator:kv - Disabling extractor name="" - it does not extract any of the required fields

[zliu]

In many of the searches over the largest index, notice entries similar to these in the search logs. Many times these entries replicate thousands and thousands of times.

INFO SearchOperator:kv - Trying to disable extractor name= INFO SearchOperator:kv - Disabling extractor name="" - it does not extract any of the required fields

What do these log entries mean? Also, can searches that have thousands and thousands of these entries be negatively impacted performance-wise?

[Ledion_Bitincka · Accepted solution]

Splunk search processes events in chunks, one of the processing steps for each chunks is field value extraction. Searches usually reference a small subset of available fields. Since field value extraction can be expensive we optimize the extraction on each chunk by disabling extraction rules if they don't extract any required fields - this is what that message indicates. As far as performance impact, the printing of these messages should have a negligible impact.

[zliu]

The user is not concerned about the writing of the
log entries, but there are thousands of attempts to extract a
field that couldn't be done. So that this an expensive use of
resource attempting to extract a field that cannot be extracted over
hundreds of thousands of records. In searches like that what is the most optimal way of telling the search to not try to extract those fields, especially if those fields are not relevant to the search running?

[stanwin]

RIght, I also noticed that fields that are not even related to that sourcetype are reported there.

To clarify does it mean SPLUNK does not actually parse the raw event to disable the 'unnecessary' extraction rules?