This is not current Splunk documentation.
Splunk 3.4.2 is the latest version. Only use this page with older Splunk 2.0.x.
Splunk 3.4.2 is the latest version. Only use this page with older Splunk 2.0.x.
Splunk User Manual (Splunk v2.0)
Faster Splunking Tricks
Use Related and Unexpected Carefully
Most modifiers don't affect the time it takes to return results. But related:: and unexpected:: require the server to examine more complex data structures. These can slow down a search.
No comments have been submitted.