Splunk Search

impact of fields command on performance

Ed_Alias
Path Finder

Hi,

i was wondering if limitating fields with the "fields" command would have any impact on performance for stats command or timechart for exemple ?

Thanks,

1 Solution

woodcock
Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

View solution in original post

woodcock
Esteemed Legend

If you are passing to stats or timestats, then you should NOT limit with fields because thise commands have the same byproduct as fields so you are doing the same work (time,CPU) twice with almost no benefit. If you are passing to transaction than there most definitely benefit because you will be saving gobs of RAM and transaction is a RAM-intensive command (so much so that it is not uncommon for it to consume all available memory and return incomplete/inaccurate results).

fdi01
Motivator

yes because working with 2 fields is faster than working with 3 or more than 3 fields.
So many more fields are the inputs of a command stats and then timechart their perfomance in rapidity is reduced

Ed_Alias
Path Finder

yeah ok but since stats are in "smart mode" non involved fields are "calculated " ?

0 Karma

chimell
Motivator
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...