how can I make search much faster ?

[perlish]

I want to search a string *xxx* in the field with 21G data using sourcetype="datafile" id="*xxx*"
how can I make search much fatser ?
Thank you !

[MarioM]

if you know what fields you want to see in the results you could only include those in your search :

sourcetype="datafile" id="*xxx*" | fields + sourcetype id otherfields

it will stop splunk trying to extract the other fields thus displaying the results faster

[dwaddle]

Searching for wildcarded strings -- especially with a wildcard on both beginning and end -- are not going to be very fast. You can look at the search job inspector output and see if there is anything there to point you at a specific cause, but my suspicion is this is hard to solve.

Your best bet for making this search much faster is to throw much more hardware at the problem. Add several indexers and distribute the data/search across them. Faster disks would probably help, too.