topic Re: Different search performance for two sourcetype in Getting Data In

Different search performance for two sourcetype

pradeepchhetri — Fri, 20 Jun 2014 09:21:21 GMT

Hi,

We have a splunk machine running with all the events going to one index. I noticed that for two different sourcetype, I got different search performance. For one of the sourcetype, searching happened very quickly but it was very slow for the other. Can someone explain me why i am getting such a difference.

Regards.

Re: Different search performance for two sourcetype

splunker12er — Fri, 20 Jun 2014 09:43:17 GMT

Can you post your search query ?

Re: Different search performance for two sourcetype

pradeepchhetri — Fri, 20 Jun 2014 09:59:16 GMT

my search query just includes: sourcetype="production" and sourcetype="staging"

Re: Different search performance for two sourcetype

MuS — Fri, 20 Jun 2014 11:22:29 GMT

Hi pradeepchhetri,

This is the kind of question, that is almost impossible for anyone to answer, except to you - because you know your setup, know your events, know your server's load and so on.....

here are some basic troubleshooting things:

do both sourcetypes have exactly the same event count over the exact same time range?
is your search head / indexer over loaded?
are there any saved searches running?
check the job inspector to get any idea why one search is running slower as the other.

you see, there is a lot to check for you.

cheers, MuS

Re: Different search performance for two sourcetype

pradeepchhetri — Fri, 20 Jun 2014 12:01:03 GMT

@Mus: Thank you for the reply. I will do the troubleshooting accordingly and let you know the outcome.

Re: Different search performance for two sourcetype

martin_mueller — Fri, 20 Jun 2014 14:43:25 GMT

I'm going to guess that production will have much more data than staging.

Re: Different search performance for two sourcetype

pradeepchhetri — Mon, 23 Jun 2014 06:48:28 GMT

@Mus: @martin_mueller: Just realized that the difference was due to fast-mode and smart-mode search types, although both has same number of events. Thank you for the help.