Deployment Architecture

Can I search static files for a keyword across all time without a performance penalty?

Contributor

I have several hundred files that have been read into Splunk that change very infrequently, but there are times I want to do keyword search across all my file sources without a time context. Is there any way to do this without the all time performance penalty?

0 Karma

Champion

If you are looking for a very specific word or continuous set of characters, then TERM() is what you want to use. That is the fastest way to find instances of a specific word.

TERM() is used in the initial search segment of your query, like this: index=... TERM(<keyword>) | ....

Champion
0 Karma