Splunk Search

Is the usage of multiple eval calculations in one pipe a feature or an unsupported hack?

HeinzWaescher
Motivator

Hi,

I did not know that it is possible:

| makeresults
| eval fieldA=123, fieldB=456, fieldC=789

I assume that this is better for search performance than

| makeresults
| eval fieldA=123
| eval fieldB=456
| eval fieldC=789

Is the first example a feature or an unsupported hack that should not be used? I've never seen it before.

Cheers

0 Karma
1 Solution

rjthibod
Champion

The first example was supported starting in version 6.4 of Splunk.

I have never heard of there being a performance gain by using the first method over the second method, so I always stick to the second method for backwards compatibility and readability.

View solution in original post

woodcock
Esteemed Legend

I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other evals to be "over there".

woodcock
Esteemed Legend

I am unaware of any performance difference but both are value. I think the latter is generally more readable because the Right-Hand-Side tends to be long and busy and people don't expect other evals to be "over there".

rjthibod
Champion

The first example was supported starting in version 6.4 of Splunk.

I have never heard of there being a performance gain by using the first method over the second method, so I always stick to the second method for backwards compatibility and readability.

View solution in original post

cmerriman
Super Champion

though, if you do have a lot of evals that are doing the same thing, i believe that foreach has a performance gain.

0 Karma

HeinzWaescher
Motivator

Readability is definitely the point why I would to stick to the second method as well. So I'm happy that there is no performance boost of the the other approach 🙂

Thanks

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!