topic Re: Where can you disable optimized search in Splunk 6.5.0? in Splunk Search

Where can you disable optimized search in Splunk 6.5.0?

fisuser1 — Mon, 03 Oct 2016 15:12:37 GMT

Does anyone know where in the console we can disable optimized search in v6.5.0?

Re: Where can you disable optimized search in Splunk 6.5.0?

lquinn — Mon, 03 Oct 2016 22:28:19 GMT

What exactly do you mean by optimized search? The new syntax highlighting? Or autocomplete?

Re: Where can you disable optimized search in Splunk 6.5.0?

Lucas_K — Mon, 03 Oct 2016 22:52:07 GMT

If its syntax highlighting then it is under each accounts settings. You can choose between 3 styles.

Re: Where can you disable optimized search in Splunk 6.5.0?

ChrisG — Mon, 03 Oct 2016 23:45:11 GMT

If you are asking about the search assistant (compact vs. full mode), it is in Account Settings > Search > Search Assistant. See Help building searches in the Search Manual for more information.

If you are asking about syntax highlighting, you can disable it in the same account settings. See Help reading searches in the Search Manual for more information.

The Search Manual also includes two topics about optimizing searches (not what you asked about, but I am adding the info here for people who might stumble on this topic in the future):

Re: Where can you disable optimized search in Splunk 6.5.0?

martin_mueller — Sat, 22 Oct 2016 21:23:28 GMT

limits.conf has a switch that you can and should set to disabled in 6.5.0:

[search_optimization]
enabled = <bool>

https://answers.splunk.com/answers/465888/if-youre-running-650-you-should-disable-search-opt.html

Re: Where can you disable optimized search in Splunk 6.5.0?

woodcock — Thu, 16 Mar 2017 04:21:33 GMT

Read this:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Quicktipsforoptimization

To turn off optimization for a specific search, the last command in your search criteria should be

|noop search_optimization=false