I'm attempting to use Splunk's API to extract some data. My configuration includes a max_count of 1, a search string with an index, oneshot execution (due to the nature of the design), earliest and latest execution times of 2 minutes, and json output as the output mode. Minimum response time is 12 seconds. Is there anything I could do differently to improve it?
I experimented with changing the search query's time limit to one minute and adding extra filters. I've tried both blocking and alternative normal exec_modes.
