noop
The noop
command is an internal, unsupported, experimental command. See
About internal commands.
Description
The noop
command is an internal command that you can use to debug your search. It includes several arguments that you can use to troubleshoot search optimization issues.
You cannot use the noop
command to add comments to a search. If you are looking for a way to add comments to your search, see Add comments to searches in the Search Manual.
Syntax
noop [search_optimization = <boolean>] [search_optimization.<optimization_type> = <boolean>]...
Required arguments
None.
Optional arguments
- search_optimization
- Syntax: search_optimization = <boolean>
- Description: Enables or disables all optimizations for the search.
- Default: true
- optimization_type
- Syntax: search_optimization.<optimization_type> = <boolean>
- Description: Enables or disables a specific type of search optimization for the search. To disable multiple optimization types, create a comma-separated list of arguments.
- Default: true
- Here are the search_optimization.<optimization_type> arguments that you can use with
noop
.
search_optimization argument Controls search_optimization.eval_merge Eval merge optimization search_optimization.merge_union Merge union optimization search_optimization.predicate_merge Predicate merge optimizations search_optimization.predicate_push Predicate pushdown optimizations search_optimization.predicate_split Predicate split optimizations search_optimization.projection_elimination Projection elimination optimizations search_optimization.required_field_values Required field value optimizations search_optimization.search_sort_normalization Predicate sort normalization search_optimization.search_flip_normalization Predicate flip normalization search_optimization.replace_append_with_union Replace append with union optimization
- For more information about specific search optimization types, see Built-in optimizations.
Usage
You can use the noop
command to enable or disable search optimizations when you run a search. Enabling or disabling search optimizations can help you troubleshoot certain kinds of search issues. For example, you might experiment with disabling and enabling search optimizations to determine whether they are causing a search to be slow to complete.
For information about managing search optimization through limits.conf
for all of the users in your Splunk platform deployment, see Built-in optimization in the Search Manual.
Managing all search optimizations with the noop command
The noop
command can enable or disable all search optimizations for a single run of a search.
If all search optimizations are enabled for your Splunk deployment in limits.conf
, you can add the following argument to the end of a search string to disable all optimizations when you run that search:
.... | noop search_optimization=false
If all search optimizations are disabled for your Splunk deployment in limits.conf
, you can add the following argument to the end of a search string to enable all search optimizations when you run that search:
.... | noop search_optimization=true
Managing specific search optimizations with the noop command
You can use the optimization_type
argument to selectively disable or enable specific types of search optimization.
Here is an example of a set of noop
arguments that disable the predicate merge and predicate pushdown optimizations for a search.
.... | noop search_optimization.predicate_merge=f, search_optimization.predicate_push=f
This example works only if you have enabled all optimizations in limits.conf
.
When you set enabled=false
for the [search_optimization]
stanza in limits.conf
you disable all search optimizations for your Splunk platform deployment. With this limits.conf
configuration, your searches can use noop
to enable all optimizations and selectively disable specific optimization types.
For example, if you have the [search_optimization]
stanza set to enabled = false
in limits.conf
, the following search enables all optimizations except projection elimination.
index=_internal | eval c = x * y / z | stats count BY a, b | noop search_optimization=true, search_optimization.projection_elimination=false
However, When you set enabled=false
for the [search_optimization]
stanza in limits.conf
, your searches cannot enable specific optimization types unless specific conditions are met. See How noop interoperates with limits.conf search optimization settings.
How the noop command interoperates with limits.conf search optimization settings
Review how you have configured search optimization for your Splunk platform deployment in limits.conf
before you use the noop
command to enable or disable optimization types. The search processor respects limits.conf
settings for optimization types only when [search_optimization]
is enabled.
For example, if the [search_optimization]
stanza is set to enabled=true
in limits.conf
, the search processor checks whether individual optimization types are enabled or disabled in limits.conf
. On the other hand, if the [search_optimization]
stanza is set to enabled = false
, the search processor does not check the settings for other optimization types. It assumes all of the optimization types are set to enabled=false
.
This search processor logic affects the way that the noop
command works when you use it to enable or disable search optimization for an individual search.
For example, imagine that you have the following configuration in limits.conf
:
[search_optimization] enabled=false [search_optimization::projection_elimination] enabled=false
With this configuration, the search processor ignores the disabled projection elimination optimization. Because [search_optimization]
is disabled, the search processor assumes all optimizations are disabled.
Say you have this configuration, and you run the following search, which uses the noop
command to enable search optimization:
.... | noop search_optimization=true
When you do this, you enable search optimization, but the search processor sees that in limits.conf
, the projection elimination optimization is disabled. It runs the search with all optimization types enabled except projection elimination.
Instead, use the noop
command in a search to enable search optimization and selectively enable the projection elimination optimization:
.... | noop search_optimization=true search_optimization.projection_elimination=true
When this search runs, it overrides both limits.conf
settings: the setting for [search_optimization]
and the setting for [search_optimization::projection_elimination]
. The search runs with all optimizations enabled.
mcatalog | redistribute |
This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10
Feedback submitted, thanks!