topic Re: Can I use search head to enhance searching speed? in Splunk Search

Can I use search head to enhance searching speed?

Raymond2T — Wed, 01 Mar 2023 12:24:59 GMT

I am newbie in splunk.

I would like to enhance the searching speed.

I am using a splunk instance in a VM (Master) that indexed different data (more than 10 imdexes at this moment).

Can I create more search head (VM- SH 1 and SH 2) to speed up the search and how can I achieve it?

Thank you

Re: Can I use search head to enhance searching speed?

richgalloway — Wed, 01 Mar 2023 13:59:18 GMT

More search heads will not enhance searching speed. Additional SHs provide capacity to run more searches.

Search heads don't actually perform searches - they coordinate the actions of indexers, which do the real searching. To enhance search performance, add more indexers then redistribute your data among them.

Re: Can I use search head to enhance searching speed?

gcusello — Wed, 01 Mar 2023 15:00:34 GMT

Hi @Raymond2T,

as @richgalloway said, adding a new search Head could be useful to have fastest searches only if you have too many concurrent searches and your Indexers are able to support them.

If you want fastest searches, you have three solutions that can also be used at the same time and obviously the best solution is to apply all of them:

using more performant disks: Splunk requires at least 800 IOPS for the data storage disks, check if your IOPS is compliant with this requirement: if not use another storage, if yes, use a more performant storage (es. SSD);
adding more resources to your Indexers, especially CPUs: remember that every search (and every subsearch) takes a CPU;
optimize your scheduled searches:
- avoiding real time searches (a search takes a cpu and releases it when finishes),
- scheduling your scheduled searches at different times,
- avoiding commands as join or transaction,
- limiting the time frames,
- using accelarations.

Ciao.

Giuseppe

Re: Can I use search head to enhance searching speed?

Raymond2T — Fri, 03 Mar 2023 01:57:55 GMT

About accelaration , how can I do it ?
On the other hand, can I use GPU to improve the performance?

Re: Can I use search head to enhance searching speed?

gcusello — Fri, 03 Mar 2023 07:43:48 GMT

Hi @Raymond2T,

adding CPUs you improve the available resources, so you reduce the queues in searches executions.

About accelerations see at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutsummaryindexing

In addition you could use Data Models (eventually accelerated) which further improves performance (https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatamodels).

Ciao.

Giuseppe

Re: Can I use search head to enhance searching speed?

richgalloway — Fri, 03 Mar 2023 13:48:04 GMT

Splunk does not support GPUs.