What's the difference between where and search in the pipeline?

[responsys_cm]

What is the difference between the following:

sourcetype=syslog | where hostname=abc

and

sourcetype=syslog | search hostname=abc

Is one faster than the other or return a different set of results?

C

[ziegfried · Accepted solution]

The where command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval and where:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

In you particular example the ... | where hostname=abc compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc that compares the hostname field value with the string "abc" similar to ... | where hostname="abc" (with the difference of where being case-sensitive).

You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.

ie.

sourcetype=syslog hostname=abc

instead of

sourcetype=syslog | search hostname=abc