There are very few suggestions about general eventtype optimization:
use app scoping to limit the number of eventtypes a search has to consider
eventtypes using just terms/phrases/wildcarded terms are sometimes computationally cheaper than eventtypes with fields in them
since eventtyping is done at search time, all fields (indexed, search time, looked up) are treated the same
There are two modes in which the splunk UI executes searches:
exploratory mode - searches in the flashtimeline view are ran this way
in this mode all fields, including eventtype, are required. This enables the
users to view the field picker and field summary etc ..
optimized mode - searches in the Advanced Charting view are ran this way (the scheduler runs searches in this mode too)
in this mode we analyze the search to determine the set of required fields and in most cases the eventtype field is not required, (unless of course the search is using the eventtype ) - thus no eventtyping is done
There is one neat trick to avoid the eventtyping even when running searches from the flashtimeline view: simply add "| fields - eventtype" to your search, for example:
"search * | fields - eventtype | stats count" - no eventtyping even in exploratory mode
Note, that the number of eventtypes a search has to consider will not linearly correlate with the performance of eventtyping - the reason for this is that many eventtypes will share terms, phrases or field comparisons which we evaluate only once.
... View more
