Hello splunkers!
Has anyone else experienced slow performance with Splunk Enterprise Security? For me, when I open the "Content Management" in "Configure" and let's say try to filter to see enabled correlation searches, it might take up to 5 minutes to load just 5 or 6 correlation searches. However, if I try to perform a search in search and reporting (Within Enterprise Security) the searches will run pretty much fast, returning hunderds of thousands of events. Another case where I might experience huge lags is when: creating a new investigation, updating the status of the notable, deleting investigation, opening Incident review settings, adding new note in investigation.
If anyone had similar experience could someone please share how to improve the performance in Enterprise Security app?
Some notes to give more info about my case:
- The health circle is green.
- The deployment is all-in-one (Splunk Enterprise, ES, and all the apps and add-ons, everything is running on ubuntu server 20.04 virtual machine with 42 GB RAM, 200 GB hard disk (thin provisioned), 32 vCPU
- My Splunk deployment has around 4-5 sources from which it receives the logs, average load of data is around 500-700 MB/day
Thanks for taking your time reading and replying to my post ❤️
