Suppose I have 1 Lac events with sourcetype = java and i am searching for keyword "xyz" with query: sourcetype=java xyz
I think search should scan all 1 Lac events and then return should matched events.
But it just scanning 12,457 events and returning 202 matched events.
why this so?
is it means splunk not searching that keyword into all 1 lac files?
↧