Splunk Search

What's the difference between host=abc and host::abc

Champion

Hi,

Was reading some doc (http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Writebettersearches) and it mentions this new way of searching for indexed fields - Specify indexed fields with <field>::<value> - Curious on what this does and how it's better than the traditional method.

Also, is there a way to determine which fields are indexed fields?

0 Karma

Splunk Employee
Splunk Employee

The :: syntax has some older history that is no longer relevant.

These days the :: syntax is used to indicate in your base search that the field::value pair is indexed. If a field is indexed then it means that we can take advantage of this all the way down to the index level of filtering. Where for search time extracted fields we can only take partial advantage of the index. Fields are indexed they are one of the built in fields as mentioned by @lstewart, you can define fields to be indexed as described here, and finally if you are indexing CSV or JSON as structured data the fields from that data will be indexed as well.

In general because of the additional filtering that can be done with the indexes themselves, if you know that across all your data sources that a field is indexed it is very beneficial to performance to use the '::' syntax, if you use it on a field that is not indexed it can filter out events unexpectedly.

Esteemed Legend

That is fantastic! The documentation definitely needs to make this more clear. I will be using this frequently now.

0 Karma

Splunk Employee
Splunk Employee

Here is a link to the list of indexed fields (see the table).
http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Aboutdefaultfields

0 Karma

Esteemed Legend

There are some very subtle differences but I am not aware of anything that would make one more efficient than the other. The main thing is that the :: syntax is the original syntax that was upgraded to allow for the more obvious = syntax which became the standard. I am surprised to see the older syntax creep back into the documentation. It is probably a documentation oversight and the thrust of this comment in context has has nothing to do with :: vs. = but rather specifying values for fields early in the search, particularly for those that are indexed.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!