We solved this problem improving the server performance with more processors and RAM.
On search.log of your search, on $HOME_SPLUNK/var/run/splunk/dispatcher/ should show something like the following to know that the ZSTD is working fine:
DEBUG BlockDecompressingStream - ZSTD block header=070434
DEBUG BlockDecompressingStream - ZSTD decided we needed input_size=57478, previous_size=65536
BlockDecompressingStream - output_offset=1179648, block_size=1048576
DEBUG BlockDecompressingStream - ZSTD decompressed block, buffered=1, isize=57478, osize=131072
DEBUG SortOperator - deserializing chunk from /opt/splunk/var/run/splunk/dispatch/1568790023.15/statstmp_partition0_1568794563.543.srs.zst
DEBUG SRSSerializer - deserializeChunk - curChunk=20 nCols=57 num=20000 nChunks=50
DEBUG SRSSerializer - readChunk: chunkMeta: nRows=1000 nBytes=208580 opts.start=0 opts.num=0 opts.append=0 globalMeta.nChunks=50 nCols=57
You need to enable DEBUG at Server settings > Server loggins for searches...
... View more