Hi @zapping575, The optimization consensus is (almost) always a base search with predicates, i.e., do this: index=foo bar=baz not this: index=foo | where bar=="baz" Event types and tags are shortcuts for the former. Pay close attention to the search job inspector. The ratio of returned results to scanned results should be, generally speaking, as close to 1:1 as possible. Writing creative SPL is fun or else we would not be here, but I will echo @PickleRick: If you find yourself modifying event types frequently, reevaluate your knowledge management practices. It may be time to pivot and adjust your source type, field extraction, event type, tag, and (hopefully) data model funnel. But if you need to be creative, be creative! Is it easier to maintain one lookup instead of a global set of eventtypes.conf and tags.conf overrides in a lexicographically "last" app, e.g., zzz_global_types? The answer is arguable, but the primary benefit of the lookup is a restart-free update. If you manage both lookup and configuration file deployment outside Splunk, however, the operational difference may be minimal. In either case, you will need to rebuild data model summaries if you use them, and the impact to searches is semantically the same. The impact to search performance is significantly worse with the combination of the lookup and where commands.
... View more
