I have a new analyst requesting to add some search time field extractions for sourcetype=syslog to simplify reporting for a subset of syslog events. I'm concerned that running all the extra extracts for searches that will not use the extracted fields will negatively impact performance for the rest of my user population.
Does Splunk optimize out unused extractions? If not, is there a good way to quantify how expensive this is gonna be?
↧