Making searches faster

We have talked about using the index to make searches faster. When starting a new investigation, following a few steps will help you get results faster:

1. Set the time to the minimum time that you believe will be required to locate relevant events. For a chatty log, this may be as little as a minute. If you don't know when the events occurred, you might search a larger time frame and then zoom in by clicking on the timeline while the search is running.
2. Specify the index if you have multiple indexes. It's good to get into the habit of starting your queries with the index name. For example, index=myapplicationindex error bob.
3. Specify other fields that are relevant. The most common fields to specify are sourcetype and host. For example, index=myapplicationindex sourcetype="impl_splunk_gen" error bob. If you find yourself specifying the field source on a regular basis, you could probably benefit from defining more source types. Avoid using the sourcetype field to capture other information, for instance, data center or environment. You would be better off using a lookup against host or creating another indexed field for those cases.

4. Add more words from the relevant messages as and when you find them. This can be done simply by clicking on words or field values in events, or field values in the field picker. For example, index=myapplicationindex sourcetype="impl_splunk_gen" error bob authclass OR fooclass.
5. Expand your time range once you have found the events that you need, and then refine the search further.
6. To disable Field discovery in earlier versions of Splunk; there was a toggle at the top of the field picker. In version 6.2 (and newer), the feature is a bit different. You can simply open the field picker and use the Select All Within Filter or Deselect All checkbox to remove any unnecessary fields from the list that Splunk will extract. This can greatly improve speed, particularly if your query retrieves a lot of events. Extracting all the fields from events simply takes a lot of computing time, and disabling this option prevents Splunk from doing all that work when not necessary. Take a look at the following screenshot:

If the query you are running is taking a long time to run, and you will be running this query on a regular basis—perhaps for an alert or a dashboard—using a summary index may be appropriate. We will discuss this in Chapter 10, Summary Indexes and CSV Files.