best way for exporting 6month vpc flow data for external reporting purpose(splunkcloud)

[imsidrai]

I have a a saved search for vpcflow logs sourcetype which searches for particular CIDR (src_ip & dest_ip) but takes almost 3 4 hrs run the query when it searches for last 6months , I want the output for external reporting , what is the best method forward to save time & resources . we dont have data models on our search head.

[richgalloway]

Please share you search so we can offer suggestions to optimize it.

VPC data can be huge so it will take time to process 6 months of it.  You should consider using a data model.  How much data is the search going through?  Is the data evenly distributed among the indexers?