https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475592#M133653 <P>I have a subsearch that I use to determine the first occurrence of the issue logged. I currently have an earliest=-4d, because the report runs every 15 minutes. If I were to extend the range to 365 days, the search would not be able to update efficiently.</P> <P>Since the data remains the same before the current day, is it possible is cache this information so the search does not delay?</P> <P>Thank you,<BR /> Lee</P> Mon, 06 Jan 2020 17:59:19 GMT lmzheng 2020-01-06T17:59:19Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475592#M133653 <P>I have a subsearch that I use to determine the first occurrence of the issue logged. I currently have an earliest=-4d, because the report runs every 15 minutes. If I were to extend the range to 365 days, the search would not be able to update efficiently.</P> <P>Since the data remains the same before the current day, is it possible is cache this information so the search does not delay?</P> <P>Thank you,<BR /> Lee</P> Mon, 06 Jan 2020 17:59:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475592#M133653 lmzheng 2020-01-06T17:59:19Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475593#M133654 <P>This sounds like a job for Summary Index.</P> <P>Run your reports every 15 minutes and save results in a summary index. Your search to find the first occurrence need only scan the summary rather than the raw data and should be much faster.</P> Mon, 06 Jan 2020 18:26:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475593#M133654 richgalloway 2020-01-06T18:26:36Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475594#M133655 <P>Is this option available for Splunk Cloud or only Splunk Enterprise?</P> Mon, 06 Jan 2020 20:12:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475594#M133655 lmzheng 2020-01-06T20:12:36Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475595#M133656 <P>Summary indexing is available in both Splunk Enterprise and Splunk Cloud.</P> Mon, 06 Jan 2020 20:23:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-a-subsearch-with-a-wide-range/m-p/475595#M133656 richgalloway 2020-01-06T20:23:44Z