Getting Data In

Log Filtering Performance Metrics or Performance Issues

jasonchangbompa
Explorer

Hi, I have an open question about splunk "log filtering" performance.

Is there any document or technical report mentioning about performance metrics which clearly shows case-by-case (e.g. depending on number of cores, etc) filtering performance?

Nothing comes out of my mind at this point regarding this performance issue, yet. But I guess you know what I'm talking about...

Best Wishes, Sung Jin

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Sorry, but I don't know what you are talking about.

First of all "log filtering" can mean a few things - many people would probably interpret a process of selectively discarding events prior to indexing. Others would think you're meaning searching for already indexed events.

As for discarding events prior to indexing the performance depends on the complexity of the regex, so there are no hard performance metrics to compare against. Depending on the setup of your Splunk infrastructure, this process can take place on either a heavy forwarder or an indexer, so even if you have very complex filtering rules, it may not affect the indexing/search performance at all.

When it comes to searching.. well.. you can write searches of varying degrees of efficiency, and still come up with the same results. It's all about knowledge of your data, and your skill in creating searches.

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...