While reading the rex article in Splunk docs, I came to know that "_raw" will somehow impact the performance, but there is no precise explanation on why "_raw" will affect the performance and in what way it going to do this. I see Splunk articles as well as here in the Splunk Answers people use _raw parameter along with the rex command. It would be really helpful if someone could explain in detail.
↧