Can I search static files for a keyword across all time without a performance penalty?

[mjones414]

I have several hundred files that have been read into Splunk that change very infrequently, but there are times I want to do keyword search across all my file sources without a time context. Is there any way to do this without the all time performance penalty?

[rjthibod]

If you are looking for a very specific word or continuous set of characters, then TERM() is what you want to use. That is the fastest way to find instances of a specific word.

TERM() is used in the initial search segment of your query, like this: index=... TERM(<keyword>) | ....

[rjthibod]

Docs are here: https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases