Why shouldn't we search index=*

[sogeniusio]

I'm interested in knowing why it's frowned upon not to search index=*. I was asked by one of our employees and remembered it being mentioned at this .conf.

[woodcock]

Which would be a more efficient search for your car keys?

"somewhere in Texas"
OR
"somewhere in Dallas"
OR
"somewhere in my house"

The more details that you give, the fewer places (buckets of compressed data) need to be searched. If you know that
index="Dallas" AND sourcetype="my house", then say so!

That being said, as long as you are fully qualifying indexed fields (e.g. host="MyHost"), it is MUCH less of a big deal. Also, if this is ad-hoc stuff, it is not too bad. It can really add up, though, if you save and schedule open-ended searches like this. A running search fully consumes a core on each indexer and the search head.

[elliotproebstel · Accepted solution]

The more restricted you can make your base search, the more efficient that search will be. So if you know your data is in index=windows_logs but instead search index=*, you are forcing Splunk to examine a very large number of buckets that won't contain your data. Narrowing your time window and your searched indexes are a really great place to start in crafting an efficient base search.

More details (and lots more tips!) can be found here:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Writebettersearches