Hello,
I currently meet some performance issue during my search (for instance, one of my search takes 75 hours with multiple sub-search for correlation). So I'm looking for some performance improvement.
That's why I try to find the exact task allocation between an indexer and a search head when we run a search on Splunk.
Let's take an example that can help you to explain me :
index=a field_1=b | eval field_2=lower(field_1) | lookup l_1 field_2 OUTPUT field_3
Also inline fields extraction is done on indexer side or search head ?
Thanks,
I think a summary index would be a good idea to retrieve results faster.
http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Usesummaryindexing
This should help you.