Splunk Search

command.search.kv performance

rettops
Path Finder

We have a search that is spending most of its time in command.search.kv. If we give it a search which doesn't need any fields, like:

index=myindex sourcetype=mytype | stats count

it takes 1.8 seconds to count the 104,000 events (that alone seems high).

If instead we give it any search which would cause it to extract fields, e.g.:

index=myindex sourcetype=mytype myfield=val1 | stats count

then the time jumps up to 9 seconds, almost all of which is in command.search.kv.

We have no custom field extractions, field transformations, field aliases or tags. Each data item does have 101 fields, but the search in question really only needs 8 of them. Is there any way to speed things up? For example, is there a way to tell Splunk to turn off all of the automatic field extractions and have it use only some user defined ones? Alternatively, is there any way to debug what's happening during command.search.kv?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can set KV_MODE to none in props.conf to turn off automatic extraction of key-value pairs.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can set KV_MODE to none in props.conf to turn off automatic extraction of key-value pairs.

landen99
Motivator

Extractions only happen for fields needed by the search.

0 Karma

rettops
Path Finder

I forgot to mention - the 9 seconds is in 'fast' mode search. In verbose mode it jumps to 18 seconds.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...