Is the usage of multiple eval calculations in one pipe a feature or an unsupported hack?

[HeinzWaescher]

Hi,

I did not know that it is possible:

| makeresults
| eval fieldA=123, fieldB=456, fieldC=789

I assume that this is better for search performance than

| makeresults
| eval fieldA=123
| eval fieldB=456
| eval fieldC=789

Is the first example a feature or an unsupported hack that should not be used? I've never seen it before.

Cheers

[woodcock]

I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other evals to be "over there".

[woodcock]

I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other evals to be "over there".

[rjthibod · Accepted solution]

The first example was supported starting in version 6.4 of Splunk.

I have never heard of there being a performance gain by using the first method over the second method, so I always stick to the second method for backwards compatibility and readability.

[cmerriman]

though, if you do have a lot of evals that are doing the same thing, i believe that foreach has a performance gain.

[HeinzWaescher]

Readability is definitely the point why I would to stick to the second method as well. So I'm happy that there is no performance boost of the the other approach 🙂

Thanks