I basically have the opposite question as can be seen here: https://community.splunk.com/t5/Splunk-Search/How-to-use-the-head-command-with-group-by/m-p/444439 I am looking for an increase in perfor...
See more...
I basically have the opposite question as can be seen here: https://community.splunk.com/t5/Splunk-Search/How-to-use-the-head-command-with-group-by/m-p/444439 I am looking for an increase in performance while keeping the search generic. As a minimal example I created this: | makeresults
| eval data=split("1;1,1;2,2;1,2;2",",")
| mvexpand data
| eval data=split(data,";")
| eval a=mvindex(data,0), b=mvindex(data,1)
| table a b
| dedup a I know that I can tremendously speed up the search if I use a template like so, using "| head 1" on each group of a: | makeresults
| append
[| makeresults
| eval data=split("1;1,1;2,2;1,2;2",",")
| mvexpand data
| eval data=split(data,";")
| eval a=mvindex(data,0), b=mvindex(data,1)
| table a b
| search a=1
| head 1
]
| append
[| makeresults
| eval data=split("1;1,1;2,2;1,2;2",",")
| mvexpand data
| eval data=split(data,";")
| eval a=mvindex(data,0), b=mvindex(data,1)
| table a b
| search a=2
| head 1
]
| search a=*
| table a b However, this way the search is no longer generic and I have to know what groups "a" can take (1,2 in this example) Question: Is there a way to increase performance on dedup while also keeping the search generic?
