Retrieve all the values for a single field

[cmak]

I am looking for a fast way to retrieve all the values for a single field. I have been doing this

index=my_index| top limit=1000 my_field

However, as I have many events, this search takes several seconds and is quite slow. I was wondering if there is a faster way to do this, or to speed it up?

[gkanapathy]

Not really. If you want every possible value, Splunk has to actually look at every single event to be sure it has them all. The main things you can do to speed it up are to use "Fast Mode" rather than "Verbose" or "Smart", or to run the search from the command line. If you're on a version older than 5.0, use the "Advanced Charting" view rather than the regular timeline view. Beyond that, the most effective way to get this search faster is to use more indexers.

[cmak]

Is there any way to specify it to make the search in fast mode using advanced XML with the Search module?

[cmak]

I found a faster way that made it slightly faster

index=my_index| stats count by my_field

Is there a better way?