I am looking for a fast way to retrieve all the values for a single field. I have been doing this
index=my_index| top limit=1000 my_field
However, as I have many events, this search takes several seconds and is quite slow. I was wondering if there is a faster way to do this, or to speed it up?
Not really. If you want every possible value, Splunk has to actually look at every single event to be sure it has them all. The main things you can do to speed it up are to use "Fast Mode" rather than "Verbose" or "Smart", or to run the search from the command line. If you're on a version older than 5.0, use the "Advanced Charting" view rather than the regular timeline view. Beyond that, the most effective way to get this search faster is to use more indexers.
Is there any way to specify it to make the search in fast mode using advanced XML with the Search module?
I found a faster way that made it slightly faster
index=my_index| stats count by my_field
Is there a better way?