i have 2 indexes Index= test index =test _summary. i have summarized the data from test index to test_summary index. I executed the SPL query: index= test |head 20000 The time taken for the job completion is 2 seconds. Then i execute the query: index= test_summary |head 20000 The time taken for that job completion is 12 seconds . Why is the job completion time taken different for different indexes even though the search time range and the mode of search is same? How do i solve this issue ? ... View more

I want a rich UI. Can Splunk use AngularJS as the UI by fetching the necessary information from Splunk? ... View more