|
In many of the searches over the largest index, notice entries similar to these in the search logs. Many times these entries replicate thousands and thousands of times. INFO SearchOperator:kv - Trying to disable extractor name= INFO SearchOperator:kv - Disabling extractor name="" - it does not extract any of the required fields What do these log entries mean? Also, can searches that have thousands and thousands of these entries be negatively impacted performance-wise? |
|
Splunk search processes events in chunks, one of the processing steps for each chunks is field value extraction. Searches usually reference a small subset of available fields. Since field value extraction can be expensive we optimize the extraction on each chunk by disabling extraction rules if they don't extract any required fields - this is what that message indicates. As far as performance impact, the printing of these messages should have a negligible impact. The user is not concerned about the writing of the log entries, but there are thousands of attempts to extract a field that couldn't be done. So that this an expensive use of resource attempting to extract a field that cannot be extracted over hundreds of thousands of records. In searches like that what is the most optimal way of telling the search to not try to extract those fields, especially if those fields are not relevant to the search running?
(09 Jul '10, 22:27)
Splunker_J ♦
|
