Splunk Search

What's the difference between where and search in the pipeline?

Builder

What is the difference between the following:

sourcetype=syslog | where hostname=abc

and

sourcetype=syslog | search hostname=abc

Is one faster than the other or return a different set of results?

C

Tags (1)
0 Karma
1 Solution

Influencer

The where command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval and where:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

In you particular example the ... | where hostname=abc compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc that compares the hostname field value with the string "abc" similar to ... | where hostname="abc" (with the difference of where being case-sensitive).

You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.

ie.

sourcetype=syslog hostname=abc

instead of

sourcetype=syslog | search hostname=abc

View solution in original post

Influencer

The where command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval and where:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

In you particular example the ... | where hostname=abc compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc that compares the hostname field value with the string "abc" similar to ... | where hostname="abc" (with the difference of where being case-sensitive).

You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.

ie.

sourcetype=syslog hostname=abc

instead of

sourcetype=syslog | search hostname=abc

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!