Splunk Search

New search button is really slow

sixcorners
Loves-to-Learn Lots

When I click new search in the context menu it opens a new tab with a search with the single field I click on.
The new search looks something like this:
*| spath severity | search severity=DEBUG
This is super slow. Is there a way to make this faster?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Where is this context menu?
Is * really the first part of the search?

---
If this reply helps you, Karma would be appreciated.
0 Karma

sixcorners
Loves-to-Learn Lots

This is the context menu. It appears when clicking on absolutely any value when using splunk to search logs. The queries it produces are really slow.

sixcorners_0-1635266653386.png

 

0 Karma

sixcorners
Loves-to-Learn Lots

yes * is really the first part of the search
Is this not a search option that everyone has?

0 Karma

sixcorners
Loves-to-Learn Lots

The context menu appears when I'm on the search results page. If I click on one of the event's values like ERROR in severity: ERROR then the context menu appears and gives three options. "Add to search", "Exclude from search", and "New search" with little icons that will open it in a new tab.
I guess it's under itsi. Here is the URL path:
/en-US/app/itsi/search

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...