Splunk Search

Splunk SPL best practice

sivaranjiniG
Path Finder

Will a parentheses Surrounded SPL queries make any difference?

For Example:
(index IN (“indexA*”,”indexB*”) source=”sourceA”) and index IN (“indexA*”,”indexB*”) source=”sourceA”

this is a big query want to know if adding  parentheses make any difference in performance wise ? 

0 Karma

adityagupta3010
Engager

Hi there,

To answer your question, the use of paranthesis doesn't affect the performance of your splunk query.

But on the other hand using a "=" instead of the "IN" function will help you; as IN is a function call and splunk processor will always first go to the function definition decode the function then resume the search query.

0 Karma

sivaranjiniG
Path Finder

Hi,
I am not sure how to use multiple indexes without using IN in the query..i dont want to use OR as it takes only one index.i want to use 2 indexes

Can you help?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The IN operator is translated into ORs before the query executes.  So

 

index IN ("indexA*","indexB*")

 

becomes

 

index "indexA*" OR index= "indexB*"

 

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust
Yes, parentheses can make a difference, but in the example given they do not.
Examine the job inspector for each search to confirm.
---
If this reply helps you, Karma would be appreciated.

sivaranjiniG
Path Finder

I checked job Inspect there is difference in seconds..as i said its a big query it may impact performance 

Thanks for suggesting me to check job inspect

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...