As Martin mueller already mentioned: your performance on indexing-side greatly depends on how fast your storage is. In my experience, a NAS is 9-out-of-10 not the fastest storage. However: Most searches run in splunk, are over the last 24hours or so. Your newly written data is also pretty recent. So it's particular the hot/warm buckets that has the largest impact (by far). My recommendation would be to store your hot buckets on local storage (/opt?) assuming that this is the fastest storage you have available, and store the rest on your NAS. An easy way to achieve this, is by using volumes in your indexes.conf. It is explained here in a little more detail. ... View more