Head not stopping the search

[Didalready]

When I use the search below, the event is 25 days ago, set search to last 30 takes 10 seconds, set to 90 days takes 23 seconds. I thought head would stop the query? Server info: Splunk 9.4.4, deleted every thing after head but didnt help speed.

The search  search index=XXXX_wineventlog host="XXXX-AV-DC01" (EventCode=4724 OR EventCode=4738) user="krbtgt"
| head 1
| eval time_since_last_event = now() - _time
| eval duration = tostring(time_since_last_event, "duration")
| eval days = round(time_since_last_event / 86400)
| eval status = if(days > 92, "krbtgt not updated", "krbtgt updated")
| fieldformat _time = strftime(_time, "%Y-%m-%d %H:%M:%S")
| table host, EventCode, _time, duration, days, status

[yuanliu · Accepted solution]

---

When I use the search below, the event is 25 days ago, set search to last 30 takes 10 seconds, set to 90 days takes 23 seconds. I thought head would stop the query? Server info: Splunk 9.4.4, deleted

---

This is a misunderstanding of how head works.  From head:

The head command is a centralized streaming command. See Command types.

And from that reference:

A streaming command operates on each event as the event is returned by a search.

In other words, each returned event will go through head, just like how piped head works in Unix.  In general, SPL does not give subsequent pipe elements control over preceding elements; they simply process results from preceding pipe, just like in Unix.   Hope this helps.