Splunk Search

impact of fields command on performance

Ed_Alias
Path Finder

Hi,

i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ?

Thanks,

1 Solution

woodcock
Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

View solution in original post

woodcock
Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

fdi01
Motivator

yes because working with 2 fields is faster than working with 3 or more than 3 fields.
So many more fields are the inputs of a command stats and then timechart their perfomance in rapidity is reduced

Ed_Alias
Path Finder

yeah ok but since stats are in "smart mode" non involved fields are "calculated " ?

0 Karma

chimell
Motivator
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...