If you are running this via the Splunk GUI (eg, not a scheduled search) then make sure that you have set the Mode in the upper right corner to "Fast." This will help, but maybe not much.
Second, when one of these searches completes, check out the Search Job Inspector - it is represented by a blue box containing an "i". The inspector contains a lot of information about how your search ran. This will tell you where most of the time was spent. Of course, you may want to ask follow-up questions about what some of those statistics mean!
In fast mode, you can eliminate the | fields _raw portion of the command.
To make better suggestions, we really need more information:
- How many events is Splunk searching? You said the search returns 97 million, but how many events did Splunk search to find that?
- Why are you writing 97 million events to disk as a csv file? There may be better ways to do this.
