https://community.splunk.com/t5/Splunk-Search/Why-does-the-query-take-so-long-to-find-time-duration/m-p/72421#M18115 <P>The data that splunk pulls out of the indexes is governed by the initial search (everything before the 1st | )</P> <P>In this case you're pulling every event for the last 30 days (from disk), then having <CODE>stats</CODE> operate on that dataset.</P> <P><A href="http://docs.splunk.com/Splexicon:Streamingcommand">This</A> describes the difference between streaming and non-streaming search commands</P> Mon, 24 Dec 2012 09:22:39 GMT jonuwz 2012-12-24T09:22:39Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-query-take-so-long-to-find-time-duration/m-p/72420#M18114 <PRE> <CODE> index=test_index | stats min(_time) AS earliest max(_time) AS latest | eval duration=latest-earliest | table duration latest earliest </CODE> </PRE> <P>When<BR /> I run this query for 30 days it takes very long to run.</P> <P>Ideally shouldn't it be running fast because its max and min time and should use efficient search to get it?</P> Mon, 24 Dec 2012 07:46:26 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-query-take-so-long-to-find-time-duration/m-p/72420#M18114 ma_anand1984 2012-12-24T07:46:26Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-query-take-so-long-to-find-time-duration/m-p/72421#M18115 <P>The data that splunk pulls out of the indexes is governed by the initial search (everything before the 1st | )</P> <P>In this case you're pulling every event for the last 30 days (from disk), then having <CODE>stats</CODE> operate on that dataset.</P> <P><A href="http://docs.splunk.com/Splexicon:Streamingcommand">This</A> describes the difference between streaming and non-streaming search commands</P> Mon, 24 Dec 2012 09:22:39 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-query-take-so-long-to-find-time-duration/m-p/72421#M18115 jonuwz 2012-12-24T09:22:39Z