Hi danielgp89!
When we say "my search for...", that means that you get to optimize whatever search you are doing in that part and it won't affect the code sample.
In this case, use the earliest command, so the search is not running across all time. You know your data, so if those sources are supposed to be sending every twenty minutes, use earliest=-1h . If they are sending every second, use earliest=-3s .
Also, just as a general tip, always specify the index that you want splunk to look at, so the system doesn't spend any time looking for your data where it isn't.
earliest=-10m index=foo source=bar1 OR source=bar2 ...my other search terms... | dedup source | table _time source
... View more