Is using index=*proxy* really bad?

[davidwaugh]

Hello

I have a question. We have lots of indexes, and rather than specify each one, I use index=*proxy* to search across index=some_proxy1 and index=some_proxy2

I understand that obviously index=* is a bad thing to do, but does index=*proxy* really cause bad things to happen in Splunk? I've been using syntax like this for several years, and nothing bad has ever happened.

I did a test on one index

with index=*proxy*

This search has completed and has returned 1,000 results by scanning 117,738 events in 7.115 seconds

with index=some_proxy1

This search has completed and has returned 1,000 results by scanning 121,162 events in 7.318 seconds

As you can see in the example using *proxy* over the same time period was actually quicker.

[gcusello]

Hi @davidwaugh ,

as @ITWhisperer said it isn't always a best practice to haveasterisk at the beginning and the end of a field value, but, for the index field isn't a grave sin.

I'm curious to understand why you have so many indexes: indexes aren't database tables, usually in Splunk you use different indexes when you have different retentions or different access grants, so why do you have so many indexes?

Using many indexes you haven't any advantage and many problems in management.

So I hint to redesign your data structure and use some indexes.

You can differentiate data flows using sourcetype and other fields.

Ciao.

Giuseppe

[ITWhisperer]

Using leading wildcards in searches is generally not a good idea, however, since this is on index it won't be searching all events in all indexes to see if the index matches, it will find the indexes from the list of indexes and only search those.