I'll concur with piebob and erga00. I also have over 10B events indexed without issue. If you have a single server on older hardware with default network setting, you might be seeing issues during large searches. Things that will be helpful in understanding why you might be seeing slowness; number of Splunk servers: If more than 1 server, what roles do they operate: server OS: server hardware (memory, CPU, NIC (speed and #)): splunk version: splunk LFCs or UFCs reporting to indexers: index=* host=* earliest=-7d | table host | dedup host number of searches run (Expensive searches): Search > Search Activity > Search details ... View more