What other commands do you avoid to save system resources?

[fedejko]

Hi,

I have a general question about which commands do you usually avoid in order to make search faster?

For example I tend to aviod transaction and join. Instead of join, when possible I try do use lookup. Also in favour of lookup, I try not to use subsearches which use | inputlookup command.

What about other commands? What other commands do you avoid to save system resources?

[gcusello]

Hi @fedejko,

commands to avoid are join and transaction, then you have to analyze your dashboard and see if you can optimize them using Post Process Search, acceleration, Summary indexes or Data Models.

Search them in Splunk documentation for details.

Lookups are a good approach when you have few data, if you have many data od data with a timestamp the other methods are better.

Ciao.

Giuseppe

[fedejko]

Thanks for your reply.

I don't analyze dashboards, only saved searches which run periodically.

So you don't mention any other resource-hungry commands apart from transaction and join?

[gcusello]

Hi @fedejko,

no, other than these two commands there aren't other heavy commands, but as I said, you have also to analyze your searches.

In other words, if you use a search on billions of events, maybe it could be useful to use a Summary index or an accelerated search or a Data Model than a lookup.

Then you have to avoid searches with * at the beginning of a field, then use positive matches than negative ones, and all the methods to optimize your searches.

Ciao.

Giuseppe