in Splunk 3 we were exporting during night time via cronjob 1-hour chunks of data from the previous day via CLI. All together more than 800000 events of data. We need the export because Splunk can´t visualize certain aspects of the data in a report.
In Splunk 3 each 1-hour chunk export took about 8 - 10 minutes to export.
In Splunk 4 the same 1-hour export takes literally HOURS to export, though one export is only about 120 - 250,000 events. Within the Splunk GUI the search takes about 1 minute to run.
We are importing the splunk-export into "CIC tool" a special "Intershop" tool to visualize certain aspects of our business. We already consulted the Splunk support about it, and they admitted that Splunk can´t do this special kind of visualization.
The problem is simply that with Splunk 3 the bulk export worked fine, but with Splunk 4 we have problems to get the data out.