Search Performance

[anupkpal]

I am doing a research through indexes in Splunk. Is there any tool which can measure search performance? If I am ingesting 100 to 300 GB/day. How many searches you can perform? Are there any other tools that can run search through indexers and also measure search performance?

Let me know.

Thanks and regards,

Anup Pal,
Solution Engineer,
SwiftStack Inc.

[cmerriman]

@anupkpal, I have removed your email address just to mask any personal information. We try to keep sensitive and personal information off of posts.

That being said, there are a few different options for monitoring system resources. One is the Monitoring Console.
https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/DMCoverview
The number of searches you can perform at any one time is more dependent on your hardware. One search request will use one CPU core on each indexer, basically. Here is some data on cores and searches.
https://docs.splunk.com/Documentation/Splunk/7.0.1/Capacity/Accommodatemanysimultaneoussearches
You can also use something like the queries in this answer to monitor searches being ran:
https://answers.splunk.com/answers/118594/determine-number-of-searches-per-day-non-scheduled.html
and you can use the job inspector of searches to see what parts of searches are taking the longest.