So I noticed that when I run two searches like the following and I am looking for a value, in this case some computer name..
index = indexA sourcetype=sourcetypeA "ComputerName"
index = indexA sourcetype=sourcetypeA dvc = ComputerName
sometimes the search with the undefined field is faster...
I would think that search time would be faster if you provide more specific details that could be seen in the bloom filters which would speed up the search in general. I am thinking that if the field dvc is not define the search defaults to looking at the raw data.
index = indexA sourcetype=sourcetypeA "ComputerName" dvc=ComputerName
It is not immediately obvious to me that a bloom filter would always be used if a field name and value is provided. If the above is faster than both the others, then each is having a limiting/accelerating factor.
If the field dvc is not an indexed field, then the field must be extracted at search time before comparison...
Another data question that I'd have if trying to investigate this, is whether your ComputerNames are all word characters, or whether they may be perceived by splunk as multiple tokens - "mycomputernameisfivewordslongandliestopeople" - which could affect performance.