Splunk Search

impact of fields command on performance

Path Finder

Hi,

i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ?

Thanks,

1 Solution

Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

View solution in original post

Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

View solution in original post

Motivator

yes because working with 2 fields is faster than working with 3 or more than 3 fields.
So many more fields are the inputs of a command stats and then timechart their perfomance in rapidity is reduced

Path Finder

yeah ok but since stats are in "smart mode" non involved fields are "calculated " ?

0 Karma

Motivator
0 Karma