Splunk Search

Why splunk do not scan all events to search a specific keyword?

Bhagyashri
Explorer

Suppose I have 1 Lac events with sourcetype = java and i am searching for keyword "xyz" with query: sourcetype=java xyz
I think search should scan all 1 Lac events and then return should matched events.
But it just scanning 12,457 events and returning 202 matched events.
why this so?
is it means splunk not searching that keyword into all 1 lac files?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Splunk is searching all 1 Lakh of events, but knows it doesn't need to look at 87633 of them because they can't contain the keyword. There are smart index structures created when the data is read into Splunk to speed up searching, a low scan count is a good sign of that.
If Splunk did scan all events your search would be much much slower.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Splunk is searching all 1 Lakh of events, but knows it doesn't need to look at 87633 of them because they can't contain the keyword. There are smart index structures created when the data is read into Splunk to speed up searching, a low scan count is a good sign of that.
If Splunk did scan all events your search would be much much slower.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...