topic Re: Splunk REST interface slow in Getting Data In

Splunk REST interface slow

DavidHourani — Sun, 21 Jul 2019 20:37:05 GMT

Hi splunkers,

Im running a multisite clustered environment with SH clustering. When I'm on any SH running searches everything runs perfectly fine except when I try to run a REST command then it runs very slow. For example the search below even running locally takes ages when trying to hit any endpoint:

| rest /servicesNS/..... splunk_server=local

Any idea what could cause the rest endpoint to give slow results ? Has anyone had similar issues ? Splunk is running in the cloud..

Update: Same configuration seams to be working on prem with no problem. What could cause such slowness on AWS ?

Re: Splunk REST interface slow

wmyersas — Thu, 17 Oct 2019 19:02:24 GMT

My guess is that this is related to what endpoints have been configured to allow rest calls - https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Restmapconf

Re: Splunk REST interface slow

DavidHourani — Tue, 05 Nov 2019 07:15:38 GMT

Heavy load on LDAP auth requests was the source of the issue.

Re: Splunk REST interface slow

effem — Tue, 05 Nov 2019 12:47:30 GMT

It basically was the way Splunk handles LDAP-Requests in Combination with 40ms more delay per request.
Having Splunk doing 1000 requests per minute isn't expensive, when the delay is under a ms. But over the internet it becomes significant and draws lots of CPU Time.