How to tell splunk to stop searching after a text is found

[cafissimo]

Hello, I have a log file with a very long record (about 255 chars) and I would like to know if and how is it possible to tell splunk to stopo searching for some text after first occurrence of the text for every record. For example, if I have a record "ABC-DEF-GHIJKABCFJEI-DEF-IJEFIJ..." I wanto splunk to stop searching after the first DEF occurence for that record and passes to the next record, so that performances are much better. Thanks in advance and kind regards.

[gkanapathy · Accepted solution]

There is no need to do this. Splunk indexed searches do not work that way. It doesn't matter how many or where "DEF" occurs in an event. If you search for "DEF" it will not be any faster. Also, 255 characters should not be considered "long".

If you are using a regex for field extractions (or in the rex command), then it does work by scanning the text of the event as you think, but in that case (depending how you write the regex) it will stop without scanning the whole string, although again, a 255-character string isn't very large.