QuestionQ46

Filtering and Formatting Results

Which commands should be used instead of a subsearch whenever possible?

  • A untable and/or xyseries
  • B stats and/or eval
  • C mvexpand and/or where
  • D bin and/or where
Explanation

stats can aggregate and calculate results across the event set, and eval can perform field and conditional calculations within the same search pipeline. Using them can eliminate a separate subsearch job and avoid the subsearch result and runtime limits. Splunk documentation notes that searches can often be rewritten to omit a subsearch.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!