I find it difficult to stop the search when I got first result in multisearch.
I tried |head 1 but it can't be implemented in multisearch
Is there anyway to stop it to enhance my search efficiency?
Because I got over 10 indexes which has over 10 million entires in each index to search.
[index = A |search ....]
[index = B |search ....]
[index = C |search ....]
[index = D |search ....]
Thank you so much.
If your subsearches does not return to many events you can use append like below.
Please try below;
index=A memberID = 1234567 |eval ID = memberID | head 1 | append [search index=B ID= 1234567 | head 1 ] | append [search index=C membernum=1234567|eval ID =membernum | head 1]
it is different because there are different indexes with different field names.
[ index=A |search memberID = 1234567 |eval ID = memberID]
[index=B |search ID= 1234567 ]
[index=C|search membernum=1234567|eval ID =membernum]
I would like to stop the subsearch of index C once first result was found as it has a huge event size, e.g. over 10GB.
I don't want it to search all 10GB data that waste a lot of time and it is definitely not a good performance.