Using an eval inside a stats commands optimizes your SPL because it allows you to run two commands in one shot.
If you take the example shown here :
You can see
| stats count(eval(status="404")) which is the equivalent of first running an eval, finding and tagging all events with stats code 404 THEN running a count on that newly created field. With eval inside the stats it's all done in one shot which is more optimal.
As for the downside, it's only that its pretty limited and you cant use all sorts of
evalexpressions inside the stats.
Let me know if that helps.
The SE added -
-- Yeah not much to add. The difference in practice will be pretty small to be perfectly honest. Same number of events, same number of computations, but doing them together will allow for better threaded-ness and memory efficiency.
Our user asked -
-- Thanks, I was curious about the efficiency of the SPL. A lot of times the queries I run hit up against memory limits, so getting more familiar with the memory usage of SPL is getting to be more important for me. I’m pretty familiar with the actual usage/syntax of that, but wasn’t sure about the efficiency.
Following on that, I know
| tstats by default does not allow nested
eval expressions. Is there another way to get the efficiency benefit of nested
evals inside a
yeah, true, it can't be used for
| tstats but that doesn't mean you can't run
tstats results and apply the
tstats as a way the fetch the initial data just like calling an index, only it's way faster on accelerated data models. Once the data is there you're free to run whatever you like on it.
And the SE added -
-- There is no way to combine
tstats with eval.
tstats is used to reference either a datamodel or the index metadata. If it’s a datamodel it may be worth adding the eval’d field to the datamodel if this is an important usecase.
Exactly, and remember the lower the cardinality of your fields in the data model, the faster it will run when you accelerate it 🙂
Sure thing @DavidHourani - thank you as always for your insights and positive energy.