[flounder3]

It has always been the Cadillac of search, and moreso with unstructured indexing (e.g. key collisions with different data structures. Foo = string vs foo = integer vs foo = array).

Your queries or infrastructure were not optimized. It’s very fast when optimized.

[chillfox]

Interesting,

It was Splunk managed and configured, so I would have thought it optimized, but I guess they made more money from it not being optimized.

If I remember right then we were throwing about 200+ GB at it a day.

[flounder3]

Splunk worked with us to optimize our configs but we always managed it ourselves.

[chillfox]

Nope, sports betting. I was on the operations side of things and Splunk was something the corporate side organised and championed, but it just couldn't be used to troubleshoot issues in the time frames we needed.