O'Reilly logo

Splunk 7 Essentials - Third Edition by Betsy Page Sigman, Erickson Delgado, J-P Contreras

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Use the fields command to improve search performance

Traditionally when building a Splunk search, you will write the search first to get the correct layout and accurate results.  Then using Splunk's fields command, the performance of the search can be improved, sometimes dramatically depending the logic contained in the search.

By default, when you search an index and return events,  Splunk will query and return all of the event fields.  However in most searches producing statistical results, having all the fields from the event is not necessary because they are not all required to create the output.

An example of a Splunk search before the fields command:

index=main http_uri=/booking/reservation http_status_code=200 | stats count by http_user_agent ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required