topic Re: Which commands scale/distribute well in Splunk Search

Which commands scale/distribute well

chris — Thu, 27 Feb 2014 13:06:55 GMT

If I have a Splunk environment/installation that consists of at least one search head and multiple indexer installations is there an easy way to determine which commands perform well (and which commands do not)?

From the following technical paper I found out, that there is a map and a reduce part for every search:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf

I am assuming that streaming commands are the ones that can be run in parallel during the map part of the search:
http://docs.splunk.com/Splexicon:Streamingcommand

I am also assuming that in the Job inspector the "remoteSearch" part is the part of the search that can be run in parallel which is efficient:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/ViewsearchjobpropertieswiththeJobInspector

From experience I know, that the "stats" command can be a much better option (from performance perspective) than "transaction".

Is there any documentation with information about performance/internals about how the commands distribute?

Thanks
Chris

Re: Which commands scale/distribute well

sophy — Thu, 27 Feb 2014 16:41:45 GMT

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

Re: Which commands scale/distribute well

Jason — Thu, 28 May 2015 16:02:03 GMT

Any update on this? I thought I heard of some document improving on http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutthesearchlanguage#Types_of_search_commands recently.