Prior to and along with the release of version 7.0, Splunk posted material that touted "optimizations to core search technology," promising decreases in the time and resources required to run data model accelerations as well as accelerated searches with faster search and DMA performance.
From reported experiences, Splunk Enterprise users appear to be constantly gaining threefold improvements on their data model acceleration time.
Note: For other types of searches, search performance improvements of two to ten times have been reported.
Splunk indicates that version 7.0 uses supplementary parallelization to convert sequential processing into multi-threaded processing in order to utilize multiple processors simultaneously in a shared-memory. And it uses improved refactored techniques to improve search performance for some types of searches or...
