I have several hundred files that have been read into Splunk that change very infrequently, but there are times I want to do keyword search across all my file sources without a time context. Is there any way to do this without the all time performance penalty?
If you are looking for a very specific word or continuous set of characters, then TERM()
is what you want to use. That is the fastest way to find instances of a specific word.
TERM()
is used in the initial search segment of your query, like this: index=... TERM(<keyword>) | ....