When you run a search, the index and time define the buckets to be considered to retrieve the data. Now, not all the buckets would have the data that you're looking for. Bloomfilter and metadata help to eliminate the buckets which are unnecessary for the search, making the data search faster (The number of eliminated buckets is what you see in eliminated_buckets in the job properties or audit.log). It then goes through multiple steps (Slices identification by querying tsidx, extract and parse data from slices, more event elimination and then processing via SPL to give you the desired output).
This is why its always recommended to include the metadata (index and source/sourcetype) and other key words in your search to make it more efficient. (Inclusion better than exclusion).
Hope this helps,
###If this helps, kindly consider upvoting/accepting as an answer###
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
