If you're looking to improve your searches there are few things that you look in order to make you searches more performant. Look at what you are trying to accomplish with your search and make your search as specific as you can. Examples of this include: Selecting the appropriate time range Take advantage of existing fields in your data to filter results as early in your search so splunk get only the necessary data Avoid using NOT as its more performant to use inclusion filters rather than exclusion If you're working in a distributed environment prioritise the use of streaming commands (eval, rex, etc.) before using transforming commands (chart, timechart, etc). this is so a good part of the search runs in the indexers rather than running in the search heads. Check the following links for more tips: https://www.splunk.com/en_us/blog/customers/splunk-clara-fication-search-best-practices.html?locale=en_us https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Writebettersearches
... View more
