Should you specify or not specify the index in your search?

[sjaworski]

What are everyone's thoughts on whether you should or should not specify the index in your search? Is sourcetype=value sufficient to reduce which indexes Splunk will search? Or will all indexes based on your role configuration still be searched even if sourcetype=value only exists in one index?

[ChrisG]

I agree with richgalloway. You want to limit the data your search will operate on. Two of the best ways to do that are (1) narrow your time range and (2) partition your data into separate indexes, then search only the relevant index. You always want to search as specifically as you can. See Quick tips for optimization and Write better searches in the Search Manual for more information.

[sjaworski]

Thanks for the links ChrisG[Splunk]

[richgalloway · Accepted solution]

I believe in specifying what you know up front. The more specific your search, the less Splunk has to read and the better it performs.

[sjaworski]

When I think in terms of flexibility and time, there may be a need in the future to change an index name. There could be a multitude of reasons to justify the change. A new index name better describes what data is contained in the index, someone does not like the name of the index, a new app uses different indexes, or the we will fix it before production mentality. Of course hindsight is 20/20 and there could always be better planning.

Easily after a year there could be hundreds of saved searches/dashboards/etc for a specific index. The Splunk admin would then need to go into each search and change the index name. After thinking about it now, I could also use a search macro and instruct people to use the macro to call the index. Then in the future if an index ever changes, I would just have update the macro to reflect the new index.

[richgalloway]

I've seen apps use macros to specify index names. They shoot themselves in the foot by calling the macro "use_index_foo", but at least they're trying.