See https://community.splunk.com/t5/Splunk-Search/Upgrade-to-5-x-some-of-my-existing-searches-are-taking...