https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482597#M8595 <H2><EM>The Splunk Product Best Practices team provided this response. Read more about <A href="https://www.splunk.com/blog/2019/02/25/how-crowdsourcing-is-shaping-the-future-of-splunk-best-practices.html">How Crowdsourcing is Shaping the Future of Splunk Best Practices</A>.</EM></H2> <H1>Better. Stronger. Faster.</H1> <P>Splunk works fine out of the box. As you increase load on your system, though, you'll want to get familiar with ways to enhance its ability to handle that load. We’ll show you how to identify the cause of slow searches and review possible trouble spots in your deployment.</P> <H1>How search optimization helps you do more with less</H1> <P>Slow searches can be caused by inefficient search practices, but they can also be caused by poor data quality. You can find remarkable performance improvements when you resolve things like the incorrect event breaks and time stamp errors in the data. Inefficiencies like these can cause indexers to work overtime both when indexing data and finding the search results. If your searches run more efficiently, they also run faster and complete sooner. Which means the system can handle more of them in the same time!</P> <P><A href="https://www.youtube.com/watch?v=TkjSeSClYaQ" target="_blank"><IMG alt="Identifying Slow Web Content" src="https://i.ytimg.com/vi/TkjSeSClYaQ/hqdefault.jpg" /></A></P> <H1>Things to know</H1> <P>Use the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview">Monitoring Console</A> dashboards to determine if any searches have performance issues that need attention. The Monitoring Console comes with preconfigured <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Customizehealthcheck">health checks</A> in addition to <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Platformalerts">platform alerts</A>. You can modify existing health checks or create new ones. You can <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide">interpret results in these dashboards</A> to identify ways to optimize and troubleshoot your deployment.</P> <UL> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide">Search activity dashboards</A></STRONG>: The <STRONG>Search activity: Instance</STRONG> and <STRONG>Search activity: Deployment</STRONG> dashboards show search activity across your deployment with detailed information broken down by instance.</LI> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Scheduleractivity">Scheduler activity dashboards</A></STRONG>: The <STRONG>Scheduler activity: Deployment</STRONG> dashboard shows information about the past executions of scheduled searches, and their success rates. If you have a search head cluster, the <STRONG>Search head clustering Scheduler delegation dashboard</STRONG> deals with how the <A href="https://docs.splunk.com/Splexicon:Clustercaptain">captain</A> orchestrates scheduler jobs.</LI> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingDeployment">Indexing performance dashboards</A></STRONG>: The <STRONG>Indexing performance: Deployment</STRONG> and <STRONG>Indexing performance: Instance</STRONG> dashboards show indexing performance across the deployment.</LI> </UL> <H1>Things to do</H1> <UL> <LI><STRONG>Run a health check</STRONG>. <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Customizehealthcheck">Access and customize the health check</A> to expose issues with source types, among other things.</LI> <LI><STRONG>Improve your source types</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Dataquality">data quality dashboards</A> to identify and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Resolvedataqualityissues">resolve data quality issues</A>.</LI> <LI><STRONG>Tune long running searches</STRONG>. Review the dashboards in the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview">Monitoring Console</A> to see if you notice any heavy consumers of CPU or memory usage.</LI> <LI><STRONG>Peek at pipelines</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingDeployment">indexing performance dashboards</A> to identify any issues or load in a particular pipeline.</LI> <LI><STRONG>Secure your Splunk</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards">safeguards for risky commands</A> in the <EM><A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/WhatyoucansecurewithSplunk">Splunk Enterprise Securing Splunk Enterprise Manual</A></EM>.</LI> </UL> Mon, 16 Sep 2019 16:04:18 GMT adukes_splunk 2019-09-16T16:04:18Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482596#M8594 <P>Does anyone have best practices to help optimize searches for Splunk Enterprise?</P> Mon, 16 Sep 2019 16:00:21 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482596#M8594 adukes_splunk 2019-09-16T16:00:21Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482597#M8595 <H2><EM>The Splunk Product Best Practices team provided this response. Read more about <A href="https://www.splunk.com/blog/2019/02/25/how-crowdsourcing-is-shaping-the-future-of-splunk-best-practices.html">How Crowdsourcing is Shaping the Future of Splunk Best Practices</A>.</EM></H2> <H1>Better. Stronger. Faster.</H1> <P>Splunk works fine out of the box. As you increase load on your system, though, you'll want to get familiar with ways to enhance its ability to handle that load. We’ll show you how to identify the cause of slow searches and review possible trouble spots in your deployment.</P> <H1>How search optimization helps you do more with less</H1> <P>Slow searches can be caused by inefficient search practices, but they can also be caused by poor data quality. You can find remarkable performance improvements when you resolve things like the incorrect event breaks and time stamp errors in the data. Inefficiencies like these can cause indexers to work overtime both when indexing data and finding the search results. If your searches run more efficiently, they also run faster and complete sooner. Which means the system can handle more of them in the same time!</P> <P><A href="https://www.youtube.com/watch?v=TkjSeSClYaQ" target="_blank"><IMG alt="Identifying Slow Web Content" src="https://i.ytimg.com/vi/TkjSeSClYaQ/hqdefault.jpg" /></A></P> <H1>Things to know</H1> <P>Use the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview">Monitoring Console</A> dashboards to determine if any searches have performance issues that need attention. The Monitoring Console comes with preconfigured <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Customizehealthcheck">health checks</A> in addition to <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Platformalerts">platform alerts</A>. You can modify existing health checks or create new ones. You can <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide">interpret results in these dashboards</A> to identify ways to optimize and troubleshoot your deployment.</P> <UL> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/SearchactivityDeploymentwide">Search activity dashboards</A></STRONG>: The <STRONG>Search activity: Instance</STRONG> and <STRONG>Search activity: Deployment</STRONG> dashboards show search activity across your deployment with detailed information broken down by instance.</LI> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Scheduleractivity">Scheduler activity dashboards</A></STRONG>: The <STRONG>Scheduler activity: Deployment</STRONG> dashboard shows information about the past executions of scheduled searches, and their success rates. If you have a search head cluster, the <STRONG>Search head clustering Scheduler delegation dashboard</STRONG> deals with how the <A href="https://docs.splunk.com/Splexicon:Clustercaptain">captain</A> orchestrates scheduler jobs.</LI> <LI><STRONG><A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingDeployment">Indexing performance dashboards</A></STRONG>: The <STRONG>Indexing performance: Deployment</STRONG> and <STRONG>Indexing performance: Instance</STRONG> dashboards show indexing performance across the deployment.</LI> </UL> <H1>Things to do</H1> <UL> <LI><STRONG>Run a health check</STRONG>. <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Customizehealthcheck">Access and customize the health check</A> to expose issues with source types, among other things.</LI> <LI><STRONG>Improve your source types</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/Dataquality">data quality dashboards</A> to identify and <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Resolvedataqualityissues">resolve data quality issues</A>.</LI> <LI><STRONG>Tune long running searches</STRONG>. Review the dashboards in the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview">Monitoring Console</A> to see if you notice any heavy consumers of CPU or memory usage.</LI> <LI><STRONG>Peek at pipelines</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/DMC/IndexingDeployment">indexing performance dashboards</A> to identify any issues or load in a particular pipeline.</LI> <LI><STRONG>Secure your Splunk</STRONG>. Review the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards">safeguards for risky commands</A> in the <EM><A href="http://docs.splunk.com/Documentation/Splunk/latest/Security/WhatyoucansecurewithSplunk">Splunk Enterprise Securing Splunk Enterprise Manual</A></EM>.</LI> </UL> Mon, 16 Sep 2019 16:04:18 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482597#M8595 adukes_splunk 2019-09-16T16:04:18Z https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482598#M8596 <P>Added related video. </P> Mon, 21 Oct 2019 17:42:52 GMT https://community.splunk.com/t5/Splunk-Dev/Best-practices-for-search-optimization-for-Splunk-Enterprise/m-p/482598#M8596 adukes_splunk 2019-10-21T17:42:52Z