https://community.splunk.com/t5/Splunk-Search/Search-optimization/m-p/528218#M149143 <P>.</P> Fri, 06 Nov 2020 18:26:06 GMT troy44112 2020-11-06T18:26:06Z https://community.splunk.com/t5/Splunk-Search/Search-optimization/m-p/528218#M149143 <P>.</P> Fri, 06 Nov 2020 18:26:06 GMT https://community.splunk.com/t5/Splunk-Search/Search-optimization/m-p/528218#M149143 troy44112 2020-11-06T18:26:06Z https://community.splunk.com/t5/Splunk-Search/Search-optimization/m-p/528222#M149146 <P>Does it need optimising?</P><P>You're trying to find src values with more than 300 events in a 45s period.&nbsp;</P><P>What is the context? Is it part of a dashboard and what is the wider time period. Optimisations can be done using summary indexes, where you calculate these counts using a scheduled search and then your query can then search the summary which will only contain the results of that query as opposed to the raw data.</P> Thu, 05 Nov 2020 21:17:47 GMT https://community.splunk.com/t5/Splunk-Search/Search-optimization/m-p/528222#M149146 bowesmana 2020-11-05T21:17:47Z