Splunk Search

format command using up memory

Contributor

I got a simple search which uses format command and I noticed that the search uses up much more memory than when I don't have any format command. Is this expected behavior ?

Tags (2)
1 Solution

Contributor

format take double the memory of results due to formatting. To limit memory usage add maxresults in search query. This will limit the number of results to return.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/format

View solution in original post

Contributor

format take double the memory of results due to formatting. To limit memory usage add maxresults in search query. This will limit the number of results to return.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/format

View solution in original post