Hi @to4kawa,
i didn't find a worst practice guide and I'm agree that it could be useful, especially for the new entries: e.g. all the people that worked with SQL and approach Splunk, start using join command in searches!
Anyway a worst practices is surely the opposite of a best practice, and I didn't find a structured guide neither to this, only some hints in a course that I followed at the beginning.
And in addition, i don't think that someone in Splunk can say that there's a worst practice: it isn't a good marketing approach!
In my experience, I try to avoid some features for performace reasons or symply to have a more readable code, these are the main worst practices I avoid:
- I try to avoid transaction and join commands every time I can and this is the main worst prectice!
- I usually use append (with attention to the number of subsearch results) without problems.
- I don't like automatic lookups so as not to lose the thread of logic of a search.
- I don't like to use DB-Connect (I use it only if I'm forced!) for security reasons and I prefer to use an export of data on a file.
Then there's something else, but less important:
- i don't like to use Field Extractor, I prefer to create fields using regexes.
- i don't like to have different different eval for each field transformation, I prefer to have one eval.
- i don't like to leave the token's name in the time picker.
- etc...
Ciao.
Giuseppe
