Monitoring Splunk

In SPL, which one has better performance when used in search queries: "case" or "if"?

gokadroid
Motivator

Hello

In SPL which one has better performance when used in search queries: "case" or "if" ?

0 Karma
1 Solution

awmorris
Path Finder

They appear virtually identical to me. I just ran both searches on my system (one using CASE and one using IF) and it has a difference of 0.28 seconds searching 1M rows.

index=fictionaldata PRODUCT=VPN| eval locality=case(COUNTRY_NAME == "United States", "Domestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.069 seconds

index=fictionaldata PRODUCT=VPN| eval locality=if(COUNTRY_NAME == "United States", "Domestic","Nondomestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.35 seconds

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

I don't believe using one over other gives any performance boost. The case is used more for SPL readability.

skoelpin
SplunkTrust
SplunkTrust

I think they are both very close in terms of performance. One thing I would suggest though is to use your highest match case first followed by the next highest all the way to the lowest being last.. This will boost performance because it will search the most frequent case first and prevent the need from having to iterate through more cases to find the match

cmerriman
Super Champion

case is for multiple arguements whereas if for three.

eval field=if(x=1,y,z) >>> if x is 1, then y, otherwise z

eval field=case(x=1,y,x=2,z,1=1,"other") >> if x is 1, then y, if x is 2, then z, if x is anything other 1 or 2, then "other"

the performance of them if they have the same x,y,z argument, is probably the same, but they were created for different reasons.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions

awmorris
Path Finder

They appear virtually identical to me. I just ran both searches on my system (one using CASE and one using IF) and it has a difference of 0.28 seconds searching 1M rows.

index=fictionaldata PRODUCT=VPN| eval locality=case(COUNTRY_NAME == "United States", "Domestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.069 seconds

index=fictionaldata PRODUCT=VPN| eval locality=if(COUNTRY_NAME == "United States", "Domestic","Nondomestic")
This search has completed and has returned 89,399 results by scanning 1,174,774 events in 23.35 seconds

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...