Accessing data become slow over time

Splunk Search

Hello,

I am uploading few logs to Splunk and accessing the data using complex tstat query. After few minutes of upload search query is taking resonalble time. but after few hours of upload when I am trying to access same data/search query , it became very slow (Almost 2-3 times slower).

1) Not sure if its because data rolled out of hot buckets.

Indexers.conf
maxHotBuckets = 3
maxWarmDBCount = 300
frozenTimePeriodInSecs = 188697600
rotatePeriodInSecs = 60

2) In Search Query Insepection, it shows most of the time spent on 3 points. but I am not sure what are these about.

50 KB

Get Updates on the Splunk Community!

Accessing data become slow over time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Accessing data become slow over time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...