Splunk Search

Example of when using indexed fields can help with search performance?

the_wolverine
Champion

We have some fields with large unique string values, e.g. EMAIL_SUBJECT, where search performance (particularly on wildcards) is poor. Some of these values may be hundreds of characters in length.

Will indexing this type of field help with search performance?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

In our case, indexing the field provided a significant search performance improvement.

View solution in original post

0 Karma

the_wolverine
Champion

In our case, indexing the field provided a significant search performance improvement.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...