Splunk Search

Splunk SPL best practice

sivaranjiniG
Path Finder

Will a parentheses Surrounded SPL queries make any difference?

For Example:
(index IN (“indexA*”,”indexB*”) source=”sourceA”) and index IN (“indexA*”,”indexB*”) source=”sourceA”

this is a big query want to know if adding  parentheses make any difference in performance wise ? 

0 Karma

adityagupta3010
Engager

Hi there,

To answer your question, the use of paranthesis doesn't affect the performance of your splunk query.

But on the other hand using a "=" instead of the "IN" function will help you; as IN is a function call and splunk processor will always first go to the function definition decode the function then resume the search query.

0 Karma

sivaranjiniG
Path Finder

Hi,
I am not sure how to use multiple indexes without using IN in the query..i dont want to use OR as it takes only one index.i want to use 2 indexes

Can you help?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The IN operator is translated into ORs before the query executes.  So

 

index IN ("indexA*","indexB*")

 

becomes

 

index "indexA*" OR index= "indexB*"

 

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust
Yes, parentheses can make a difference, but in the example given they do not.
Examine the job inspector for each search to confirm.
---
If this reply helps you, Karma would be appreciated.

sivaranjiniG
Path Finder

I checked job Inspect there is difference in seconds..as i said its a big query it may impact performance 

Thanks for suggesting me to check job inspect

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...