How can I fine tune the splunk queries which are very slow and return huge amount of data which finally causes the search head to be very slow?

[macadminrohit]

Hi,

We have some queries which are very slow and return a huge amount of data which finally causes the search head to be very slow. Is there a general document or something which can help us fine tune the queries.

[macadminrohit]

Is there any way to measure the query performance before and after the optimization.

[gjanders]

The job inspector provides useful information for comparing the efficiency of search queries.

[493669 · Accepted solution]

Hi @macadminrohit,
Refer docs :http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Quicktipsforoptimization
http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/Writebettersearches
and answer by @Simeon https://answers.splunk.com/answers/24082/best-tips-for-speeding-up-searches.html