Splunk Search

savedsearch vs outputlookup- Which one is more efficient to use and should be used as default?

MaxJ
New Member

I run large searches at the start of each month. Generally I use the saved search commands to retrieve the results on dashboards - e.g. | savedsearch report_name. However, we sometimes use outputlookup at the end of the search and inputlookup to retrieve the data on the dashboard - e.g. | outputlookup report_file.csv. 

I have recently had some issues with saved search:

  • jobs being deleted that causes my saved searches disappear
  • For saved searches to be refreshed the report needs to rescheduled and run again
  • Odd behaviour with reports running but data not actually being picked up by dashboards

These issues do not apply to outputlookup reports which can more easily be re-run and also can easily be edited with lookup editor if required.

Can anybody tell me which is more efficient to use and should be the default option? Are there any advantages and disadvantages to either command I have not considered?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

savedsearch and outputlookup (we really should be talking about intputlookup) are very different commands.

The savedsearch command returns data from your indexes (although they also can access lookups, databases, and any other source available with SPL) whereas inputlookup only looks at lookup files.  The former is presumed to be using fresh data (it depends on the search), but lookups could be stale.

Lookups can be manipulated, but that's harder to do with indexed data.

Lookups can be deleted, too.

The command to use depends on your needs.  Use the one that does the job you need to do.

Which is more efficient?  It depends.  Searches can be very efficient or not, depending on what they do.  Lookups can be fast, but they have to be maintained and that maintenance process may be very inefficient.  Also, lookups (usually) are part of the knowledge bundle sent to each indexer so a lot of lookups or very large lookups can make the bundle process inefficient.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @MaxJ,

if the result to display is fixed and you don't need to know the old values, I'd use the lookup.

If the result need to consider also the time variance (e.g. results of the last month) you could use a Summary index.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...