Splunk Search

Undocumented Search Operator TERM()


It seems that the undocumented TERM() operator can give quite a performance boost to searches.

E.g. I ran a search on "WINDOWS7$" which is also segmented into "WINDOWS7" and "$".

Running the search as TERM(WINDOWS7$) was 2x faster. Can someone explain what is happening behind the curtain, and why this gem is not mentioned in the documentation?

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

New Member

You can see in lipsy what it's doing in the search.log
maybe have to enable debug not sure

0 Karma

Splunk Employee
Splunk Employee

Now documented in the Search Reference.

Splunk Employee
Splunk Employee

the soon-to-be-documented TERM operator tells Splunk to treat whatever is inside the parenthesis as a single term in the index, even if it contains characters that are usually recognized as breaks or delimiters.

for example, if you searched for "more_coffee", Splunk ends up searching for "more" and "coffee" and post filtering the results.

if you know that the term/phrase "more_coffee" definitely exists in the index, you can force Splunk to find it by using TERM(more_coffee).

i won't speak for the search performance. but, 4.3 handles rare-term searches much more efficiently. (yay bloom filters!)

Splunk Employee
Splunk Employee

To further clarify, the reason we can't automatically assume "more_coffee" is in the index is due to the nature of minor breakers like '_'

If you have an event that has something like a_b_c_d

we will index a,b,c,d and a_b_c_d, but not b_c or the like.

Therefore if you search for b_c, we can't assume you don't also want b_c when it occurs inside something like a_b_c_d, which would be excluded if you used TERM(b_c)


Did you have some example timed results? I have been running it on my test 4.3 system and the times appear to be on average around identical between using the two.
Using the search inspector (this is where I also got the search run-time from) it doesn't appear that TERM actually adds anything or removes anything from the search process, it looks to me as if it is interpreted as just containing the required search terms.

It may just be that my test data isn't complex enough to provide any interesting results but I can't find any difference in the search inspector.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...