https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482511#M8589 <P>Does anyone have best practices to help optimize searches for Splunk Cloud? </P> Mon, 16 Sep 2019 15:18:14 GMT adukes_splunk 2019-09-16T15:18:14Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482511#M8589 <P>Does anyone have best practices to help optimize searches for Splunk Cloud? </P> Mon, 16 Sep 2019 15:18:14 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482511#M8589 adukes_splunk 2019-09-16T15:18:14Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482512#M8590 <H2><EM>The Splunk Product Best Practices team provided this response. Read more about <A href="https://www.splunk.com/blog/2019/02/25/how-crowdsourcing-is-shaping-the-future-of-splunk-best-practices.html">How Crowdsourcing is Shaping the Future of Splunk Best Practices</A>.</EM></H2> <H1>Better. Stronger. Faster.</H1> <P>Splunk works fine out of the box. As you increase load on your system, though, you'll want to get familiar with ways to enhance its ability to handle that load. We’ll show you how to identify the cause of slow searches and review possible trouble spots in your deployment.</P> <H1>How search optimization helps you do more with less</H1> <P>Slow searches can be caused by inefficient search practices, but they can also be caused by poor data quality. You can find remarkable performance improvements when you resolve things like the incorrect event breaks and time stamp errors in the data. Inefficiencies like these can cause indexers to work overtime both when indexing data and finding the search results. If your searches run more efficiently, they also run faster and complete sooner. Which means the system can handle more of them in the same time!</P> <H1>Things to know</H1> <P>Use Splunk Cloud Monitoring Console (CMC) <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/User/DMCoverview#Dashboards">dashboards</A> to determine if any searches have performance issues that need attention. The CMC enables you to <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/User/DMCoverview">monitor Splunk Cloud deployment health</A> and to <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/User/DMCoverview#Self-service_Splunk_Cloud:_Enable_platform_alerts">enable platform alerts</A>. You can modify existing alerts or create new ones. You can interpret results in these <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/WebFramework">dashboards</A> to identify ways to optimize and troubleshoot your deployment.</P> <UL> <LI><STRONG>Search Usage Statistics</STRONG>: This dashboards shows search activity across your deployment with detailed information broken down by instance.</LI> <LI><STRONG>Scheduler Activity</STRONG>: This dashboard shows Information about scheduled search jobs (reports) and you can <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Report/Configurethepriorityofscheduledreports">configure the priority of scheduled reports</A>.</LI> <LI><STRONG>Forwarders: Instance and Forwarders: Deployment</STRONG>: These dashboards show information about forwarder connections and status. Read about how to <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Forwarding/Receiverconnection">troubleshoot forwarder/receiver connection</A> in <STRONG><EM>Forwarding Data</EM></STRONG>.</LI> </UL> <H1>Things to do</H1> <UL> <LI><STRONG>Access the Splunk Cloud Monitoring Console (CMC)</STRONG>. <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/User/DMCoverview">Monitor Splunk Cloud deployment health</A> and <A href="https://docs.splunk.com/Documentation/SplunkCloud/latest/User/DMCoverview#Self-service_Splunk_Cloud:_Enable_platform_alerts">enable platform alerts</A>.</LI> <LI><STRONG>Improve your source types</STRONG>. Review the data quality dashboards to identify and <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Resolvedataqualityissues">resolve data quality issues</A>.</LI> <LI><STRONG>Check the HTTP Event Collection Status</STRONG>: If you have <A href="http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/UsetheHTTPEventCollector">set up and use HTTP Event Collector</A> to monitor the progress of a token.</LI> </UL> <P><A href="https://www.youtube.com/watch?v=9awwyjORWO8" target="_blank"><IMG alt="Using the Splunk HTTP Event Collector (HEC)" src="https://i.ytimg.com/vi/9awwyjORWO8/hqdefault.jpg" /></A></P> Mon, 16 Sep 2019 15:20:40 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482512#M8590 adukes_splunk 2019-09-16T15:20:40Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482513#M8591 <P>Added related video. </P> Mon, 21 Oct 2019 17:27:38 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Cloud/m-p/482513#M8591 adukes_splunk 2019-10-21T17:27:38Z