What is the difference between the following:
sourcetype=syslog | where hostname=abc
and
sourcetype=syslog | search hostname=abc
Is one faster than the other or return a different set of results?
C
The where
command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval
and where
:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
In you particular example the ... | where hostname=abc
compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc
that compares the hostname field value with the string "abc"
similar to ... | where hostname="abc"
(with the difference of where
being case-sensitive).
You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.
ie.
sourcetype=syslog hostname=abc
instead of
sourcetype=syslog | search hostname=abc
The where
command allows you to evaluate more complex/structured expressions and is probably a little less efficient. Here's a list of functions you can use with eval
and where
:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
In you particular example the ... | where hostname=abc
compares the value of the hostname field to the value of the abc field. As opposed to ... | search hostname=abc
that compares the hostname field value with the string "abc"
similar to ... | where hostname="abc"
(with the difference of where
being case-sensitive).
You should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency.
ie.
sourcetype=syslog hostname=abc
instead of
sourcetype=syslog | search hostname=abc