Hello,
I am very new to Splunk. I have got it up and running on a Linux Box and analyzing some IIS logs and everything works perfect.
But my question is I saved a search with a date range of March 1 to March 31. These logs have about 2 million hits or events. It takes a long time to build.
Is there not a way once the events are scanned not to re-scan them? Just that it takes like 15 minutes every time I open the search.
Thanks
Mike
When you saved did you hit save results or save search? It sounds like you might have done the latter which will re-populate the data every time as you are saving the search criteria instead of the results. If you save the search results even 2 million hits shouldn't take that long to come back. These options are under the Actions dropdown.
Once the results are saved you can find them in the Jobs section.
Perfect ... Thanks!