impact of fields command on performance

[Ed_Alias]

Hi,

i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ?

Thanks,

[woodcock · Accepted solution]

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

[fdi01]

yes because working with 2 fields is faster than working with 3 or more than 3 fields.
So many more fields are the inputs of a command stats and then timechart their perfomance in rapidity is reduced

[Ed_Alias]

yeah ok but since stats are in "smart mode" non involved fields are "calculated " ?

[chimell]

hi

see this link

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fields