I find it difficult to stop the search when I got first result in multisearch.
I tried |head 1 but it can't be implemented in multisearch
Is there anyway to stop it to enhance my search efficiency?
Because I got over 10 indexes which has over 10 million entires in each index to search.
[index = A |search ....]
[index = B |search ....]
[index = C |search ....]
[index = D |search ....]
Thank you so much.
If your subsearches does not return to many events you can use append like below.
Please try below;
index=A memberID = 1234567 |eval ID = memberID | head 1 | append [search index=B ID= 1234567 | head 1 ] | append [search index=C membernum=1234567|eval ID =membernum | head 1]
Are these sub searches totally different? If you can share your searches (anonymized) we can find another way to achieve your goal.
it is different because there are different indexes with different field names.
[ index=A |search memberID = 1234567 |eval ID = memberID]
[index=B |search ID= 1234567 ]
[index=C|search membernum=1234567|eval ID =membernum]
I would like to stop the subsearch of index C once first result was found as it has a huge event size, e.g. over 10GB.
I don't want it to search all 10GB data that waste a lot of time and it is definitely not a good performance.
There is no such mechanism.