Splunk Search
Highlighted

Which is a faster search strategy for filters on multiple columns?

Communicator

I have a table which returns multiple columns and I want to implement a text filter on each of these columns. Currently I'm doing:

| search columnA="$a$"
| search columnB="$b$"
| search columnC="$c$"

But I'm wondering if it's quicker to simply do multiple AND statements on 1 search? Is there an even quicker method?

0 Karma
Highlighted

Re: Which is a faster search strategy for filters on multiple columns?

Builder

doing all three in the same search inherently does an AND in between them

columnA="$a$" columnB="$b$" columnC="$c$"

is the same as

columnA="$a$" AND columnB="$b$" AND columnC="$c$"

View solution in original post

Highlighted

Re: Which is a faster search strategy for filters on multiple columns?

Communicator

I was hoping that piping the searches makes the search be performed only on the result of the previous search, potentially saving performance? Is there a better way then?

0 Karma
Highlighted

Re: Which is a faster search strategy for filters on multiple columns?

Builder

I believe it does narrow the search results with each one via a map & reduce function. Johnathon Cervelli described this stuff to me in a SplunkLive a few years back and I believe it does a search where it finds the first term (map), then using that subset (reduce) it performs a search with the second term (map) and narrows the field down further (reduce), then repeats for each term. The one way to slow it down is to put it all in quotes where it then has to do a couple additional searches to ensure the terms are in order specified in your quotes.

...edit - oops, I meant for this to be a reply to your last message

Highlighted

Re: Which is a faster search strategy for filters on multiple columns?

Splunk Employee
Splunk Employee

If you want to test and see for yourself, then inspect the job and look how long both searches took. See if you can find a good sized data (don't try to compare searches that finish within, say, 5 seconds since that's too fast).