All Apps and Add-ons

Why am I getting a high Skipped search ratio on f5 networks analytics (new) Data Models

New Member

I am getting about a 99% skip ratio for f5 data models that do not complete. The searches take quite some time to summarize the datamodels and I need to adjust the settings most likely. What I am concerned about is that this is a prebuilt datamodel for the f5 application and I do not want to modify any of the settings that will conflict with the application.

What can I do to fix this without messing up the application?

The maximum number of concurrent auto-summarization searches on this instance has been reached 624828 97.33 %
The maximum number of concurrent historical scheduled searches on this instance has been reached 17113 2.67 %

I increased the number of searches per core to 4 and I don't have any performance problems with that regard. What settings do I need to change now to help fix this issue?

0 Karma


Also make sure you define the specific index in the macro "f5_index" in the App.

0 Karma


I just went through this.

The F5 app accelerates 50 models by default. Make sure you need all of those.

Basically every 5 minutes it is trying to run 3 acceleration searches times 50 models over three month period. That is absurd. I would start by disabling all of them and looking for what data you actually have and/or care about and selectively re-enable them as needed.

Also consider going into advanced acceleration settings and reducing the concurrent acceleration searches to 1 if you need to enable a bunch of these.

0 Karma
Get Updates on the Splunk Community!

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...