Required arguments

None.

Optional arguments

Optimization type arguments

Here are the search_optimization.<optimization_type> arguments that you can use with noop.

For more information about specific search optimization types, see Built-in optimizations.

Log level expression options

Appender expression options

Managing all search optimizations with the noop command

The noop command can enable or disable all search optimizations for a single run of a search.

If all search optimizations are enabled for your Splunk deployment in limits.conf, you can add the following argument to the end of a search string to disable all optimizations when you run that search:

.... | noop search_optimization=false

If all search optimizations are disabled for your Splunk deployment in limits.conf, you can add the following argument to the end of a search string to enable all search optimizations when you run that search:

.... | noop search_optimization=true

Managing specific search optimizations with the noop command

You can use the optimization_type argument to selectively disable or enable specific types of search optimization.

Here is an example of a set of noop arguments that disable the predicate merge and predicate pushdown optimizations for a search.

.... | noop search_optimization.predicate_merge=f, search_optimization.predicate_push=f

This example works only if you have enabled all optimizations in limits.conf.

When you set enabled=false for the [search_optimization] stanza in limits.conf you disable all search optimizations for your Splunk platform deployment. With this limits.conf configuration, your searches can use noop to enable all optimizations and selectively disable specific optimization types.

For example, if you have the [search_optimization] stanza set to enabled = false in limits.conf, the following search enables all optimizations except projection elimination.

index=_internal | eval c = x * y / z | stats count BY a, b | noop search_optimization=true, search_optimization.projection_elimination=false

However, When you set enabled=false for the [search_optimization] stanza in limits.conf, your searches cannot enable specific optimization types unless specific conditions are met. See How noop interoperates with limits.conf search optimization settings.

How the noop command interoperates with limits.conf search optimization settings

Review how you have configured search optimization for your Splunk platform deployment in limits.conf before you use the noop command to enable or disable optimization types. The search processor respects limits.conf settings for optimization types only when [search_optimization] is enabled.

For example, if the [search_optimization] stanza is set to enabled=true in limits.conf, the search processor checks whether individual optimization types are enabled or disabled in limits.conf. On the other hand, if the [search_optimization] stanza is set to enabled = false, the search processor does not check the settings for other optimization types. It assumes all of the optimization types are set to enabled=false.

This search processor logic affects the way that the noop command works when you use it to enable or disable search optimization for an individual search.

For example, imagine that you have the following configuration in limits.conf:

[search_optimization]
enabled=false

[search_optimization::projection_elimination]
enabled=false

With this configuration, the search processor ignores the disabled projection elimination optimization. Because [search_optimization] is disabled, the search processor assumes all optimizations are disabled.

Say you have this configuration, and you run the following search, which uses the noop command to enable search optimization:

.... | noop search_optimization=true

When you do this, you enable search optimization, but the search processor sees that in limits.conf, the projection elimination optimization is disabled. It runs the search with all optimization types enabled except projection elimination.

Instead, use the noop command in a search to enable search optimization and selectively enable the projection elimination optimization:

.... | noop search_optimization=true search_optimization.projection_elimination=true

When this search runs, it overrides both limits.conf settings: the setting for [search_optimization] and the setting for [search_optimization::projection_elimination]. The search runs with all optimizations enabled.

Use noop to set debugging channels for a search

The log_<level> argument lets you set the debugging channel for a search at a specific log level, such as debug or warn. You might use this if you need to set the log level for a specific search but do not have CLI access to the Splunk platform implementation.

The Splunk platform changes the log level after it parses the noop command. It can do this before the search head parses arguments from other search commands, even if it comes after those commands in the search string. For instance, the following search properly logs some debug messages from the makeresults command despite the fact that it precedes the noop command:

| makeresults  count=1 | noop log_debug="MakeResultsProcessor"

However, the log_<level> argument cannot set the log level for search process components that are ahead of SPL argument processing in the order of operations. For example, LicenseMgr is one of those components. When you run this search, it still logs at the default level of info for LicenseMgr even though you specify debug in the SPL.

index=_internal | head 1 | noop log_debug="LicenseMgr"

If you have command-line access and you need to debug an issue with that component or ones like it, you can modify $SPLUNK_HOME/etc/log-searchprocess.cfg directly to set the logging level before the search is dispatched and produce more verbose output in search.log.

The noop command must be part of the streaming pipeline. Because the Splunk software performs argument parsing on the search head and then pushes the search to the indexers, make sure that the noop command is part of the streaming pipeline. Place the noop command before the first non-streaming command in the search string. An easy way to do this is to put it after the first command in the search string, which is usually search.

The log_<level> argument supports wildcard matching. You can also set different log levels for different debugging channels in the same search.

.... | noop log_debug=Cache* log_info="SearchOperator:kv;SearchOperator:multikv"

For more information about logs and setting log levels for debugging channels, see What Splunk logs about itself in the Troubleshooting Manual.

Use noop to apply log-searchprocess.cfg appender attribute changes to a search job

For debugging purposes, you can use noop to apply changed attributes for log-searchprocess.cfg appenders to individual runs of a search. Appenders are blocks of configurations for specific sub-groups of log components. Example appenders include searchprocessAppender, watchdog_appender, and searchTelemetryAppender. You can use the * wildcard to select all appenders.

For example, the following search changes the maximum size of the search.log file to 50 MB and sets the maximum number of rolled search.log files to 99.

.... | noop log_appender="searchprocessAppender;maxFileSize=50000000;maxBackupIndex=99"

These changes are applied for the lifetime of that particular search. They are not saved or applied to other searches.

You can only change values for the following appender attributes: maxFileSize, maxBackupIndex, ConversionPattern, and maxMessageSize. Values you supply for maxFileSize, maxBackupIndex, and maxMessageSize must be higher than the current values for those appender attributes in log-searchprocess.cfg.

For more information about changing appender attributes for log debugging purposes, see Enable log debugging in the Troubleshooting Manual.