All Apps and Add-ons

Why am I getting a high Skipped search ratio on f5 networks analytics (new) Data Models

nathigSOS
New Member

I am getting about a 99% skip ratio for f5 data models that do not complete. The searches take quite some time to summarize the datamodels and I need to adjust the settings most likely. What I am concerned about is that this is a prebuilt datamodel for the f5 application and I do not want to modify any of the settings that will conflict with the application.

What can I do to fix this without messing up the application?

The maximum number of concurrent auto-summarization searches on this instance has been reached 624828 97.33 %
The maximum number of concurrent historical scheduled searches on this instance has been reached 17113 2.67 %

I increased the number of searches per core to 4 and I don't have any performance problems with that regard. What settings do I need to change now to help fix this issue?

0 Karma

mschlapfer
Explorer

Also make sure you define the specific index in the macro "f5_index" in the App.

0 Karma

anm_mporter
Explorer

I just went through this.

The F5 app accelerates 50 models by default. Make sure you need all of those.

Basically every 5 minutes it is trying to run 3 acceleration searches times 50 models over three month period. That is absurd. I would start by disabling all of them and looking for what data you actually have and/or care about and selectively re-enable them as needed.

Also consider going into advanced acceleration settings and reducing the concurrent acceleration searches to 1 if you need to enable a bunch of these.

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...