Is it possible to change the default search performance to "high_perf" in splunkcloud?
On splunkcloud in the search bar you have the option of setting search performance to: standard_perf (search default), limited_perf, high_perf or Policy-Based Pool.
I have begun using high_perf for my queries since otherwise things are WAY too slow. However it constantly changes me back to the default standard_perf. I cannot find the setting for this anywhere and have had no luck searching for documentation either.
The recommended method of workload pool assignment is automatic assignment by workload rules.
You can override this seting manually by selecting specific workload pool when creating a scheduled report or summary acceleration but the recommended waymof managing workload assignment is by workload rules.
So if you want to change workload assignment policy, you have to edit your workload assignment rules
https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Admin/WorkloadManagement
Thank you for linking that. Looks like I'll need to spend a bit of time understanding how to optimize everything. Unfortunately I won't have time to dive deep on the optimization work for a bit.
Do you happen to know how to change the search default for ad-hoc searches (like when I'm trying a new query out) with that system?