Fairly new to Splunk and I am trying to understand the reason for the difference in results and search time for the following:
Created an extracted field for a Windows log - WinTempFieldType
When I run a search for: WinTempFieldType=Error
Search takes seconds, less that a full minute and finds less than 100 results
When I run a search for: WinTempFieldType=* | search WinTempFieldType=Error
Search takes 15 minutes and finds 5,000+ results
I ran across this, because I have a report that has a table that I based off the following search: WinTempFieldType=* | stats count WinTempFieldType | sort -count | table WinTempFieldType count
When the report ran the table showed the WinTempFieldType row with Error and a count over 5,000 - but when I clicked on the error cell to drill down, the pending search only showed less than 100 results. So that is when I tried to manually replicate the issue and got the same results. Now I am just trying to understand WHY?
