Hello,   is it possible that splunk changed the way how it calculates the search time? I have searches with "152,98 startup.handoff" and "This search has completed and ... in 2.272 seconds. " so without putting the huge handoff time in there. Looks like benchmark cheating 😉   Regards Arnim     ... View more

Well, as mentioned in the provided link's answer the reasons can vary. It can be your local Windows box, it can be your SSD - because having a SSD does not automatically mean you will benefit from it's theoretical I/O speed. I would suggest to have a closer look at the machine specs and if the minimum specs are met http://docs.splunk.com/Documentation/Splunk/6.4.2/Installation/Systemrequirements#Recommended_hardware and use Perfmon data to monitor what happens if you start a search on your box. ... View more

This also fixed the issue I was having. Thank you! ... View more