topic Splunk 6 REST API: Much slower than 5 in Getting Data In

Splunk 6 REST API: Much slower than 5

twinspop — Tue, 10 Dec 2013 17:32:37 GMT

I upgraded our indexers to Splunk 6 about 3 weeks ago. Our monitoring scripts use the REST interface to hit Splunk. Since the upgrade, calls to the REST API have slowed considerably. (Showing 95th % search run time for the REST API user.)

Anyone else notice similar?

I'm just starting the investigation. (Didn't notice til this morning - doh!) Pointers to likely sources of the delay appreciated.

Re: Splunk 6 REST API: Much slower than 5

twinspop — Sat, 18 Jan 2014 00:14:36 GMT

For the record: In the case of one of my saved searches, I can run the exact same search through the GUI on the exact same indexer and get an answer back in 1.5s. If I use the API, the response takes 25-30s.

Re: Splunk 6 REST API: Much slower than 5

austremestephen — Tue, 28 Jan 2014 02:30:27 GMT

version 6 API response is very slow compared with version 5.

Re: Splunk 6 REST API: Much slower than 5

ineeman — Tue, 28 Jan 2014 03:20:42 GMT

What OS are you running on? Also, the UI ends up using the API as well, so it is odd it is much faster in the UI. In the search inspector for both jobs (ones started from the UI and ones from the API), do you see any marked difference, especially in the 'request' field (which should be a JSON dictionary)?

Re: Splunk 6 REST API: Much slower than 5

dball2 — Wed, 13 Jan 2016 19:13:12 GMT

I have a similar problem, a query in the UI is taking around 10sec, and via searches export it takes > 4mins. Using splunk cloud API.

Incredibly slow. Someone should look at that .