Splunk Search

Why splunk do not scan all events to search a specific keyword?

Bhagyashri
Explorer

Suppose I have 1 Lac events with sourcetype = java and i am searching for keyword "xyz" with query: sourcetype=java xyz
I think search should scan all 1 Lac events and then return should matched events.
But it just scanning 12,457 events and returning 202 matched events.
why this so?
is it means splunk not searching that keyword into all 1 lac files?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Splunk is searching all 1 Lakh of events, but knows it doesn't need to look at 87633 of them because they can't contain the keyword. There are smart index structures created when the data is read into Splunk to speed up searching, a low scan count is a good sign of that.
If Splunk did scan all events your search would be much much slower.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Splunk is searching all 1 Lakh of events, but knows it doesn't need to look at 87633 of them because they can't contain the keyword. There are smart index structures created when the data is read into Splunk to speed up searching, a low scan count is a good sign of that.
If Splunk did scan all events your search would be much much slower.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...