Hi,
I have a number of scheduled searches which run significantly faster than the same search run from the search-bar. I have no idea why this would happen - are there some settings that might cause this? The scheduled search is about 30-40 seconds (runs every 30 minutes throughout the day). The same adhoc search runs for minutes.
Search:
index=raytheon_proxy dstBytes>0
|eval totbytes=bytes/1024/1024/1024
|chart sum(totbytes)
↧