How to stop searching when first result was found in each index in multisearch

[Raymond2T]

Hello 

I find it difficult to stop the search when I got first result in multisearch.

I tried |head 1  but it can't be implemented in multisearch 

Is there anyway to stop it to enhance my search efficiency?

Because I got over 10 indexes which has over 10 million entires in each index to search.
|multisearch
[index = A |search ....]
[index = B |search ....]
[index = C |search ....]
[index = D |search ....]

....

Thank you so much.

[scelikok]

Hi @Raymond2T,

If your subsearches does not return to many events you can use append like below.

Please try below;

index=A memberID = 1234567 |eval ID = memberID | head 1
| append [search index=B ID= 1234567 | head 1 ]
| append [search index=C membernum=1234567|eval ID =membernum | head 1]

[scelikok]

Hi @Raymond2T,

Are these sub searches totally different? If you can share your searches (anonymized) we can find another way to achieve your goal.

[Raymond2T]

it is different because there are different indexes with different field names.

For example

|multisearch

[ index=A |search memberID = 1234567 |eval ID = memberID]

[index=B |search ID= 1234567 ]

[index=C|search membernum=1234567|eval ID =membernum]

I would like to stop the subsearch of index C once first result was found as it has a huge event size, e.g. over 10GB.

I don't want it to search all 10GB data that waste a lot of time and it is definitely not a good performance.

Thank you

[starcher]

There is no such mechanism.