https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25946#M4944 <P>Not really. If you want every possible value, Splunk has to actually look at every single event to be sure it has them all. The main things you can do to speed it up are to use "Fast Mode" rather than "Verbose" or "Smart", or to run the search from the command line. If you're on a version older than 5.0, use the "Advanced Charting" view rather than the regular timeline view. Beyond that, the most effective way to get this search faster is to use more indexers.</P> Sat, 09 Feb 2013 02:05:06 GMT gkanapathy 2013-02-09T02:05:06Z https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25944#M4942 <P>I am looking for a fast way to retrieve all the values for a single field. I have been doing this</P> <PRE><CODE>index=my_index| top limit=1000 my_field </CODE></PRE> <P>However, as I have many events, this search takes several seconds and is quite slow. I was wondering if there is a faster way to do this, or to speed it up?</P> Sat, 09 Feb 2013 00:42:53 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25944#M4942 cmak 2013-02-09T00:42:53Z https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25945#M4943 <P>I found a faster way that made it slightly faster</P> <PRE><CODE>index=my_index| stats count by my_field </CODE></PRE> <P>Is there a better way?</P> Sat, 09 Feb 2013 00:54:41 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25945#M4943 cmak 2013-02-09T00:54:41Z https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25946#M4944 <P>Not really. If you want every possible value, Splunk has to actually look at every single event to be sure it has them all. The main things you can do to speed it up are to use "Fast Mode" rather than "Verbose" or "Smart", or to run the search from the command line. If you're on a version older than 5.0, use the "Advanced Charting" view rather than the regular timeline view. Beyond that, the most effective way to get this search faster is to use more indexers.</P> Sat, 09 Feb 2013 02:05:06 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25946#M4944 gkanapathy 2013-02-09T02:05:06Z https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25947#M4945 <P>Is there any way to specify it to make the search in fast mode using advanced XML with the Search module?</P> Mon, 11 Feb 2013 17:47:41 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-all-the-values-for-a-single-field/m-p/25947#M4945 cmak 2013-02-11T17:47:41Z