Splunk Search

Example of when using indexed fields can help with search performance?

the_wolverine
Champion

We have some fields with large unique string values, e.g. EMAIL_SUBJECT, where search performance (particularly on wildcards) is poor. Some of these values may be hundreds of characters in length.

Will indexing this type of field help with search performance?

Tags (2)
0 Karma
1 Solution

the_wolverine
Champion

In our case, indexing the field provided a significant search performance improvement.

View solution in original post

0 Karma

the_wolverine
Champion

In our case, indexing the field provided a significant search performance improvement.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...