Splunk SPL best practice

[sivaranjiniG]

Will a parentheses Surrounded SPL queries make any difference?

For Example:
(index IN (“indexA*”,”indexB*”) source=”sourceA”) and index IN (“indexA*”,”indexB*”) source=”sourceA”

this is a big query want to know if adding  parentheses make any difference in performance wise ? 

[adityagupta3010]

Hi there,

To answer your question, the use of paranthesis doesn't affect the performance of your splunk query.

But on the other hand using a "=" instead of the "IN" function will help you; as IN is a function call and splunk processor will always first go to the function definition decode the function then resume the search query.

[sivaranjiniG]

Hi,
I am not sure how to use multiple indexes without using IN in the query..i dont want to use OR as it takes only one index.i want to use 2 indexes

Can you help?

[richgalloway]

The IN operator is translated into ORs before the query executes.  So

index IN ("indexA*","indexB*")

becomes

index "indexA*" OR index= "indexB*"

[richgalloway]

Yes, parentheses can make a difference, but in the example given they do not.
Examine the job inspector for each search to confirm.

[sivaranjiniG]

I checked job Inspect there is difference in seconds..as i said its a big query it may impact performance 

Thanks for suggesting me to check job inspect