Splunk Search

What other commands do you avoid to save system resources?

fedejko
Explorer

Hi,

I have a general question about which commands do you usually avoid in order to make search faster?

For example I tend to aviod transaction and join. Instead of join, when possible I try do use lookup. Also in favour of lookup, I try not to use subsearches which use | inputlookup command.

What about other commands? What other commands do you avoid to save system resources?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

commands to avoid are join and transaction, then you have to analyze your dashboard and see if you can optimize them using Post Process Search, acceleration, Summary indexes or Data Models.

Search them in Splunk documentation for details.

Lookups are a good approach when you have few data, if you have many data od data with a timestamp the other methods are better.

Ciao.

Giuseppe

0 Karma

fedejko
Explorer

Thanks for your reply.

I don't analyze dashboards, only saved searches which run periodically.

So you don't mention any other resource-hungry commands apart from transaction and join?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @fedejko,

no, other than these two commands there aren't other heavy commands, but as I said, you have also to analyze your searches.

In other words, if you use a search on billions of events, maybe it could be useful to use a Summary index or an accelerated search or a Data Model than a lookup.

Then you have to avoid searches with * at the beginning of a field, then use positive matches than negative ones, and all the methods to optimize your searches.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...