Splunk Search

how can I make search much faster ?

perlish
Communicator

I want to search a string *xxx* in the field with 21G data using sourcetype="datafile" id="*xxx*"
how can I make search much fatser ?
Thank you !

0 Karma

MarioM
Motivator

if you know what fields you want to see in the results you could only include those in your search :

sourcetype="datafile" id="*xxx*" | fields + sourcetype id otherfields

it will stop splunk trying to extract the other fields thus displaying the results faster

dwaddle
SplunkTrust
SplunkTrust

Searching for wildcarded strings -- especially with a wildcard on both beginning and end -- are not going to be very fast. You can look at the search job inspector output and see if there is anything there to point you at a specific cause, but my suspicion is this is hard to solve.

Your best bet for making this search much faster is to throw much more hardware at the problem. Add several indexers and distribute the data/search across them. Faster disks would probably help, too.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...