We had search query were we extract field 1 and field 2 using regular expressions. We have doubt here that which of the dashboards will load faster
case 1:
dashboard whose extracted fields are saved in props.conf
case 2:
dashboard whose extracted fields are directly using them in search query
Please help us in which case works efficient
P.S: In both cases no of events and search queries are same only the fields change
It depends. if you did the field extractions at index time ( TRANSFORMS-
) and the extracted fields are used to qualify your base search, then case 1 will be faster. Otherwise it should be the same. In any case, you can easily test this out by using the Job Inspector
:
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ViewsearchjobpropertieswiththeJobInspector
It depends. if you did the field extractions at index time ( TRANSFORMS-
) and the extracted fields are used to qualify your base search, then case 1 will be faster. Otherwise it should be the same. In any case, you can easily test this out by using the Job Inspector
:
http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/ViewsearchjobpropertieswiththeJobInspector
Hi,
Case 1 always will be equal or faster than Case2.
Also with case 1 you have the field able to filter and dont have to make a rex and then filter:
index=a field1=1
is better than
index=a |rex "(?<field1>\d)" | search field1 = 1
In a distributed environment the extaction of the fileds is pulled to the indexer to optimize the query just to be able to filter in the indexer and don't have to send all to the search head and then filter.