Is S.o.S - Splunk on Splunk or Distributed Management Console (DMC) a better option to check search concurrency in a Search Head Cluster?

[rbal_splunk]

I have Search head cluster and will like to monitor Search Concurrency. Could you please clarify my best option? Will SOS of Distributed Management Console (DMC) a better option for me?

[rbal_splunk · Accepted solution]

The recommendation is to use distributed Management Console views to calculate search activity & concurrency for Cluster.S.o.S is not certified to work with SHC
DMC has views like assess search activity & concurrency and earch activity - instance wide- which can display this information-by app / user / search type, etc.

another panel that you may find interesting is "Aggregate Search Runtime" which expresses the search workload not just in terms of the number of searches running concurrently, but in cumulative search runtime.