https://community.splunk.com/t5/Knowledge-Management/Search-Factor-Question-In-regards-to-search-speed-what-is-the/m-p/348203#M6078 <P>I'm currently not using indexer clustering. I'm on all flash storage and I'm looking into increasing the speed of some of my larger indexes, which are about 4-5TB and growing. When I run a 1 day search it is uber slow. CPU performance and memory performance is 10-50%. Would indexer clustering with dedication to searchability factor help me? What would I aim to do to increase search speed? I know there's some customers out there with petabytes of ingestion daily, and I'm betting they don't wait a year for a 15min search to complete.</P> <P>Thanks</P> Wed, 18 Apr 2018 11:18:42 GMT bgagliardi1 2018-04-18T11:18:42Z https://community.splunk.com/t5/Knowledge-Management/Search-Factor-Question-In-regards-to-search-speed-what-is-the/m-p/348203#M6078 <P>I'm currently not using indexer clustering. I'm on all flash storage and I'm looking into increasing the speed of some of my larger indexes, which are about 4-5TB and growing. When I run a 1 day search it is uber slow. CPU performance and memory performance is 10-50%. Would indexer clustering with dedication to searchability factor help me? What would I aim to do to increase search speed? I know there's some customers out there with petabytes of ingestion daily, and I'm betting they don't wait a year for a 15min search to complete.</P> <P>Thanks</P> Wed, 18 Apr 2018 11:18:42 GMT https://community.splunk.com/t5/Knowledge-Management/Search-Factor-Question-In-regards-to-search-speed-what-is-the/m-p/348203#M6078 bgagliardi1 2018-04-18T11:18:42Z https://community.splunk.com/t5/Knowledge-Management/Search-Factor-Question-In-regards-to-search-speed-what-is-the/m-p/348204#M6079 <P>Hey@bgagliardi1,</P> <P>Following are the options to consider:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Aboutsummaryindexing">http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Aboutsummaryindexing</A><BR /> 1. Use base search to run searches.<BR /> 2. Use loadjob searches<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob">https://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Loadjob</A><BR /> 3. Use accelerated reports<BR /> 4. Use data-model acceleration <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Acceleratedatamodels">http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Acceleratedatamodels</A><BR /> 5. Make sure you add filters in the start of the search.<BR /> 6. Use Summary indexing <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Usesummaryindexing</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch">http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch</A><BR /> Let me know if this helps!!</P> Wed, 18 Apr 2018 11:57:15 GMT https://community.splunk.com/t5/Knowledge-Management/Search-Factor-Question-In-regards-to-search-speed-what-is-the/m-p/348204#M6079 deepashri_123 2018-04-18T11:57:15Z