best tips for speeding up searches?

One could write a Novel on this, but I'll focus on reporting type searches...

• Use the Advanced Charting view - this typically speeds up most searches of this type
• From a the "search" view: remove any unnecessary field extractions by: turning off field discovery; using the fields command so that it only returns the field you desire (eg - "my error | fields host").
• For reports that need to analyze millions of events AND they are run consistently, use summary indexing
• Create a dashboard that persists a saved search (see below)
• For dashboards, create a saved search and force the dashboard to use the persisted result (useHistory parameter)
• If you have multiple indexes, search the specific index you need to report on.
  
• If your result set contains indexed fields, leverage them in your search (by default Splunk indexes host source and sourcetype)
• Create a distributed search environment and leverage the map/reduce feature (add an indexer)
• For extremely large summary search reports on systems where you have many cpus available for searching, schedule parallel searches on subsets of the data
• If your search environment is distributed and you DON'T need to run it remotely, use the 'localop' command (e.g. - a local summary index search or geoip lookup)

-