Which of the following is a correct Splunk search that will return results in the most performant way?

Question

Options

• Aindex=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min |
• B| stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min
• Cindex=foo host=i-478619733 | transaction src_ip |stats count by host
• Dindex=foo | transaction src_ip |stats count by host | search host=i-478619733

• A
  81% (17)
• B
  5% (1)
• C
  10% (2)
• D
  5% (1)

Explanation

Option A is correct because it follows Splunk's core performance principle: filter early using indexed fields (index=foo host=i-478619733) before passing data to transforming commands, and it uses stats - a highly efficient streaming command - rather than the expensive transaction command.

B is invalid syntactically - you cannot place index=foo in the middle of a pipeline after a transforming command like stats; index and host constraints must appear in the initial search string before the first pipe.

C is incorrect because transaction is one of Splunk's most resource-intensive commands, holding events in memory to group them. When stats can accomplish the same goal (as it can here), it should always be preferred.

D is incorrect because it applies host=i-478619733 as a late-pipeline search filter, meaning Splunk processes the entire index=foo dataset through transaction and stats before narrowing results - the opposite of efficient.

Memory tip: Think "filter, then transform" - indexed field filters (index=, host=, source=, sourcetype=) belong at the front of your search, and stats beats transaction whenever you just need aggregation, not full event correlation.

No community discussion yet for this question.