Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: impact of fields command on performance
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ?
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes because working with 2 fields is faster than working with 3 or more than 3 fields.
So many more fields are the inputs of a command stats and then timechart their perfomance in rapidity is reduced
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeah ok but since stats are in "smart mode" non involved fields are "calculated " ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
