Hi everyone, I have strange Splunk behavior regarding one of the indexes but first a little bit of background: Environment is indexer cluster with 1 SH Proxy logs are getting ingested from syslog server via universal forwarder (monitor input) Monitor input uses host_segment option to extract host data Sourcetype is set to "cisco:wsa:squid" from splunkbase app "Splunk_TA_cisco-wsa". I'm not using any local configuration for that sourcetype (on any instance) There are no props.conf stanzas that apply configuration based on source or host (i.e. [host::something]) for this specific source or host The issue: When I'm using the search 1 (with field "host") in fast mode it is 10 to 20 times slower than using search 2. Search 1 index=my_index sourcetype=cisco:wsa:squid| fields _time, _indextime, source, sourcetype, host, index, splunk_server, _raw Search 2 index=my_index sourcetype=cisco:wsa:squid| fields _time, _indextime, source, sourcetype, index, splunk_server, _raw I have already reviewed full configuration an there is no configuration on any of the instances that is modifying field "host" in any way and when I use it in my search it is drastically slower which is causing issues further down the line. This issue does not manifest on other indexes. All indexes are configured with same options in indexes.conf Hope someone can give me a good clue for troubleshooting.
... View more
