Splunk Search

New search button is really slow

sixcorners
Loves-to-Learn Lots

When I click new search in the context menu it opens a new tab with a search with the single field I click on.
The new search looks something like this:
*| spath severity | search severity=DEBUG
This is super slow. Is there a way to make this faster?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Where is this context menu?
Is * really the first part of the search?

---
If this reply helps you, Karma would be appreciated.
0 Karma

sixcorners
Loves-to-Learn Lots

This is the context menu. It appears when clicking on absolutely any value when using splunk to search logs. The queries it produces are really slow.

sixcorners_0-1635266653386.png

 

0 Karma

sixcorners
Loves-to-Learn Lots

yes * is really the first part of the search
Is this not a search option that everyone has?

0 Karma

sixcorners
Loves-to-Learn Lots

The context menu appears when I'm on the search results page. If I click on one of the event's values like ERROR in severity: ERROR then the context menu appears and gives three options. "Add to search", "Exclude from search", and "New search" with little icons that will open it in a new tab.
I guess it's under itsi. Here is the URL path:
/en-US/app/itsi/search

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...