Splunk Search

New search button is really slow

sixcorners
Loves-to-Learn Lots

When I click new search in the context menu it opens a new tab with a search with the single field I click on.
The new search looks something like this:
*| spath severity | search severity=DEBUG
This is super slow. Is there a way to make this faster?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Where is this context menu?
Is * really the first part of the search?

---
If this reply helps you, Karma would be appreciated.
0 Karma

sixcorners
Loves-to-Learn Lots

This is the context menu. It appears when clicking on absolutely any value when using splunk to search logs. The queries it produces are really slow.

sixcorners_0-1635266653386.png

 

0 Karma

sixcorners
Loves-to-Learn Lots

yes * is really the first part of the search
Is this not a search option that everyone has?

0 Karma

sixcorners
Loves-to-Learn Lots

The context menu appears when I'm on the search results page. If I click on one of the event's values like ERROR in severity: ERROR then the context menu appears and gives three options. "Add to search", "Exclude from search", and "New search" with little icons that will open it in a new tab.
I guess it's under itsi. Here is the URL path:
/en-US/app/itsi/search

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...