Splunk Search

Help understanding the commands - Search vs Where after first pipe

Kukkadapu
Path Finder

Hi , Can you help me understanding "search" vs "where" command after first pipe. Is there any performance impact because of using either one?

Thanks

0 Karma
1 Solution

masonmorales
Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

View solution in original post

jplumsdaine22
Influencer

Kukkadapu
Path Finder

Thanks for your time and links jplumsdaine22 :).

0 Karma

masonmorales
Influencer

where is used strictly for comparison operations (e.g. fieldX!=fieldY, numeric_field>500, etc.), whereas search is used for actual search expressions (e.g. search foo OR bar NOT field=x "and some phrase" OR whatever keywords you want etc.).

I haven't tested the performance impact of the two but I assume if you are doing a comparison (because that's the only one you could do with both), the performance would be the same. You could try it both ways and use the job inspector to see what the completion time is for each way to determine which is faster for your use case.

martin_mueller
SplunkTrust
SplunkTrust

Additionally, move as much filtering as you can into search before the first pipe.

(Exception: Report Acceleration / Postprocessing / etc. scenarios where you pre-compute a data cube style thingy and feed many things off it, here filtering late can make sense)

Kukkadapu
Path Finder

That makes sense. Thanks for your time 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...