https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182414#M7730 <P>My search head is getting very slow. How to reduce the response time of search head?</P> Fri, 21 Aug 2015 05:41:42 GMT Madhan45 2015-08-21T05:41:42Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182414#M7730 <P>My search head is getting very slow. How to reduce the response time of search head?</P> Fri, 21 Aug 2015 05:41:42 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182414#M7730 Madhan45 2015-08-21T05:41:42Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182415#M7731 <P>If possible, you should provide more information.</P> <P>Do you use a single search head? Are your searches slow? Is the response time of the web ui slow? have you taken a look at the performance of your machine? Is there a high cpu / memory utilization? Is it one certain search that is slow? etc...</P> Fri, 21 Aug 2015 09:57:42 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182415#M7731 tom_frotscher 2015-08-21T09:57:42Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182416#M7732 <P>Cpu and memory utilization are below 40%. yes UI part of search head is very slow.because the macro and saved search which we use in run time are very big. that could be the reason i guess.</P> <P>Is there any way to optimize this response time?</P> Fri, 21 Aug 2015 10:01:42 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182416#M7732 Madhan45 2015-08-21T10:01:42Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182417#M7733 <P>So it is fast to open a dashboad or go to the settings etc ?</P> <P>But you have to wait a long time until a certain big search is returning results?</P> <P>If so, it depends on your search. Maybe we can help you optimize it. Therefore, you have to provide more information about this specific search if possible.</P> Fri, 21 Aug 2015 10:06:05 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182417#M7733 tom_frotscher 2015-08-21T10:06:05Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182418#M7734 <P>It could be dependent on many things, your indexing volume per day, the number of indexers, their hardware and performance, the number of cores in your search head, as well as the type of search being run. Could you specify the amount of indexing volume (or your license volume per day) as well as the number of indexers, the hardware assigned to your search head and an example of a slow search?</P> Fri, 21 Aug 2015 12:38:32 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182418#M7734 tskinnerivsec 2015-08-21T12:38:32Z https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182419#M7735 <P>Do you use the Splunk on Splunk (SoS) app? It can help provide insights into both your search heads and indexer performance. It's new to me but the search activity app can help identify some badly performing searches. And of course there's the *nix and Windows apps to look at OS performance issues.</P> <P>I also like reviewing some of the past conference papers at places like </P> <P><A href="http://conf.splunk.com/speakers/2014.html#">http://conf.splunk.com/speakers/2014.html#</A></P> <P>including the Jiffy Lube Quick Tune-Up and Splunk Monitoring Console presentations.</P> Sun, 23 Aug 2015 00:06:53 GMT https://community.splunk.com/t5/Knowledge-Management/How-to-optimize-search-head-performance/m-p/182419#M7735 mfrost8 2015-08-23T00:06:53Z