When should I use search_optimization?

[yutaka1005]

I don't understand when "search_optimization" will be used.
And like below situation, there is the scene that search doesn't work.

Issue number:SPL-145968
https://docs.splunk.com/Documentation/Splunk/7.0.0/ReleaseNotes/KnownIssues

So I want to know when "search_optimization" was used, and which search "search_optimization" was used to.
How can I do this?

Are kind of these informations in the internal logs?

[niketn · Accepted solution]

@yutaka1005, unless Search Optimization is turned off, it should always be applicable for all searches. However what you should be worried about is whether optimized search is different from original or not. If it is whether it is for better or worse.

Once a search runs you can compare original search with optimized using one of the following options:

Option 1: You can open Job Inspector and check out the Search job properties which should list out Optimized Search as well.

Option 2: Use REST end point **
**Step 1: Run a search with | addinfo command to get YourSearchID
Step 2: Use the following REST API with YourSearchID fetched in the previous step. Compare the original query with optimized.

|  rest /services/search/jobs/<YourSearchID>
|  table request.custom.search optimizedSearch

PS: Documentation link for REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...

Following is the documentation on Search Optimization. As mentioned under certain circumstances, noop search_optimization=false would be required when the optimized search does not work as expected compared to the actual search.
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...

Also refer to one of the questions from @martin_mueller on the same topic. You can add in your issue details if it is on similar lines:
https://answers.splunk.com/answers/465888/if-youre-running-650-you-should-disable-search-opt.html

[yutaka1005]

Thank you for comment.

It was very helpful that you told me how to figure out information of Optimized Search.

[niketn]

@yutaka1005, if this has helped please accept the answer. If not please ask further questions that you may have, community members would surely be able to assist.