How do you make Splunk searches fast?

Retrieve as little data from disk as possible and filter as early as possible: narrow the time range, search specific terms, choose the right index, and drop unneeded fields and events before computing statistics.

The expensive part of any search is reading events from disk. Everything that reduces that amount pays off:

• Split data into separate indexes when different data types are rarely searched together (web data in one, firewall data in another), then name the index in the search.
• Search as specifically as possible: fatal_error, not *error*. Leading wildcards cannot use the index.
• Limit the time range to what you need: -1h instead of -1w.
• Filter out unnecessary fields and results early, before stats, eval or sorting.
• Precompute frequent values with summary indexes.
• Fast disk I/O for indexers.

The underlying principle is the same as in SQL: push filters down to where the data is read, and aggregate only what is left.

Go deeper:

• Splunk — Write better searches — the official optimisation guide.