how to prevent the spam on search function?

Question

I’d suggest prohibiting spam users first.

But above all, I’m not aware about the performance of the Search Meter plugin. Using free tool like Google Analytics or StatCounter you can verify the searches really occurred or not.

Workaround

As you have the exact timestamp when the search occurred you can also get the user’s identity, such as IP address. Any free tool like Google Analytics or StatCounter can help you gaining that.

In Wikipedia, prohibiting bad users, we sometimes block IP address of the user.

A plugin

<?php
/**
 * Plugin Name: WPSE Restrict Unwanted Users
 * Author: 22728
 * Version: 1.0.0
 */

/**
 * Get the user's IP address
 * 
 * For the prohibition of multiple vote count on Star Rating, we are grabbing the
 * user's IP address and storing it to database for the time we want to restrict
 * the user into voting again.
 * 
 * @author Barış Ünver
 * @link   http://code.tutsplus.com/articles/creating-a-simple-contact-form-for-simple-needs--wp-27893
 * 
 * @return string IP address, formatted.
 */
function wpse_306059_22728_get_the_ip() {
    if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
        return $_SERVER["HTTP_X_FORWARDED_FOR"];
    }
    elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
        return $_SERVER["HTTP_CLIENT_IP"];
    }
    else {
        return $_SERVER["REMOTE_ADDR"];
    }
}

/**
 * Restrict the user and display a message.
 *
 * @see wpse_306059_22728_get_the_ip()
 * @see wp_die()
 * 
 * @return void
 */
function wpse_306059_22728_restrict_user() {
    // Get the list of blocked IP address in comma separated string.
    $black_list="0.0.0.0, 1.1.1.1, ::1"; // use get_option('your_spam_user_block_list')

    // make it an array
    $block_array     = explode(',', $black_list);
    $block_array     = array_map('trim', $block_array); // remove the spaces

    // get current user's IP address
    $current_user_ip = wpse_306059_22728_get_the_ip();

    // Restrict the user
    if( in_array($current_user_ip, $block_array) ) {
        $message="<h3>". __('Access Restricted', 'wpse-restrict-unwanted-users') .'</h3>';
        $message .= '<p>'. __( 'It seems the IP address you are using is spamming us. We are sorry for your inconvenience, but your access to the site is restricted.', 'wpse-restrict-unwanted-users' ) .'</p>';
        $message .= '<p>'. sprintf(
                            __( 'If the message seems wrong to you, please contact us by emailing at: <strong>%s</strong>', 'wpse-restrict-unwanted-users' ),
                            antispambot( '[email protected]' )
                        ) .'</p>';

        wp_die(
            $message, // message
            __( 'Access Restricted', 'wpse-restrict-unwanted-users' ) // page title
        );
    }
}

add_action( 'wp', 'wpse_306059_22728_restrict_user' );

NOTE
In line #44 I put the blacklisted IP addresses hard coded. It’d be better to use the WordPress’ Options API and using a textarea enter the restricted IP addresses, and save ’em in to the options table, and then use get_option() to get the value in that variable.

Be Aware
Blocking users with IP address has its own caveat also. If the IP address is not dedicated, the next authentic user using the same IP would be blocked.

In that case you can take a temporary block action. You can constantly add/remove IP addresses to see any performance improvement. But if you don’t care, never mind.

Workaround

A plugin

Related Posts: