Splunk Search

savedsearch vs outputlookup- Which one is more efficient to use and should be used as default?

MaxJ
New Member

I run large searches at the start of each month. Generally I use the saved search commands to retrieve the results on dashboards - e.g. | savedsearch report_name. However, we sometimes use outputlookup at the end of the search and inputlookup to retrieve the data on the dashboard - e.g. | outputlookup report_file.csv. 

I have recently had some issues with saved search:

  • jobs being deleted that causes my saved searches disappear
  • For saved searches to be refreshed the report needs to rescheduled and run again
  • Odd behaviour with reports running but data not actually being picked up by dashboards

These issues do not apply to outputlookup reports which can more easily be re-run and also can easily be edited with lookup editor if required.

Can anybody tell me which is more efficient to use and should be the default option? Are there any advantages and disadvantages to either command I have not considered?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

savedsearch and outputlookup (we really should be talking about intputlookup) are very different commands.

The savedsearch command returns data from your indexes (although they also can access lookups, databases, and any other source available with SPL) whereas inputlookup only looks at lookup files.  The former is presumed to be using fresh data (it depends on the search), but lookups could be stale.

Lookups can be manipulated, but that's harder to do with indexed data.

Lookups can be deleted, too.

The command to use depends on your needs.  Use the one that does the job you need to do.

Which is more efficient?  It depends.  Searches can be very efficient or not, depending on what they do.  Lookups can be fast, but they have to be maintained and that maintenance process may be very inefficient.  Also, lookups (usually) are part of the knowledge bundle sent to each indexer so a lot of lookups or very large lookups can make the bundle process inefficient.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
Esteemed Legend

Hi @MaxJ,

if the result to display is fixed and you don't need to know the old values, I'd use the lookup.

If the result need to consider also the time variance (e.g. results of the last month) you could use a Summary index.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...