All Apps and Add-ons
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

Why is Splunk slow when using radius authentication?

jonare
Engager
‎04-25-2022 02:59 AM

Hello

I have installed and setup RADIUS Authentication radius_auth 1.4.1, all autentiction is correct and radius user are comming up with the admin role.

The problem is that when searching a index splunk is taking a long time to fetch the data, when looking through logs I found the logs below in splunkd.log, these lines appear when running a search, alot of them. Only when using radius, not when using a local user. Seems like this is the reason for search being slow, but not sure what is going on. Can anyone help ?. Thnx 

 

4-25-2022 11:45:24.154 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~55.19 milliseconds to execute. elapsed_msec=56
04-25-2022 11:45:24.204 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~49.04 milliseconds to execute. elapsed_msec=50
04-25-2022 11:45:24.248 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.72 milliseconds to execute. elapsed_msec=44
04-25-2022 11:45:24.293 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.53 milliseconds to execute. elapsed_msec=45
04-25-2022 11:45:24.342 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~49.53 milliseconds to execute. elapsed_msec=50
04-25-2022 11:45:24.397 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.63 milliseconds to execute. elapsed_msec=55
04-25-2022 11:45:24.453 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.95 milliseconds to execute. elapsed_msec=55
04-25-2022 11:45:24.496 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.16 milliseconds to execute. elapsed_msec=44
04-25-2022 11:45:24.558 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~61.56 milliseconds to execute. elapsed_msec=62
04-25-2022 11:45:24.609 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~50.98 milliseconds to execute. elapsed_msec=51
04-25-2022 11:45:24.652 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.98 milliseconds to execute. elapsed_msec=42
04-25-2022 11:45:24.704 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.82 milliseconds to execute. elapsed_msec=52
04-25-2022 11:45:24.756 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.36 milliseconds to execute. elapsed_msec=52
04-25-2022 11:45:24.798 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~42.03 milliseconds to execute. elapsed_msec=43
04-25-2022 11:45:24.851 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.72 milliseconds to execute. elapsed_msec=53
04-25-2022 11:45:24.898 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~47.39 milliseconds to execute. elapsed_msec=48
04-25-2022 11:45:24.954 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.91 milliseconds to execute. elapsed_msec=55
04-25-2022 11:45:24.996 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.97 milliseconds to execute. elapsed_msec=42
04-25-2022 11:45:25.041 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.70 milliseconds to execute. elapsed_msec=45
04-25-2022 11:45:25.085 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.48 milliseconds to execute. elapsed_msec=44
04-25-2022 11:45:25.135 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~50.13 milliseconds to execute. elapsed_msec=51
04-25-2022 11:45:25.183 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~47.50 milliseconds to execute. elapsed_msec=48
04-25-2022 11:45:25.237 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~54.03 milliseconds to execute. elapsed_msec=55
04-25-2022 11:45:25.290 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.35 milliseconds to execute. elapsed_msec=53
04-25-2022 11:45:25.334 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.71 milliseconds to execute. elapsed_msec=44
04-25-2022 11:45:25.388 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.50 milliseconds to execute. elapsed_msec=54
04-25-2022 11:45:25.439 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.03 milliseconds to execute. elapsed_msec=52
04-25-2022 11:45:25.490 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.24 milliseconds to execute. elapsed_msec=52
04-25-2022 11:45:25.534 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~42.78 milliseconds to execute. elapsed_msec=43
04-25-2022 11:45:25.587 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.18 milliseconds to execute. elapsed_msec=54
04-25-2022 11:45:25.641 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.47 milliseconds to execute. elapsed_msec=54
04-25-2022 11:45:25.686 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~44.53 milliseconds to execute. elapsed_msec=45
04-25-2022 11:45:25.729 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~43.21 milliseconds to execute. elapsed_msec=44
04-25-2022 11:45:25.775 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~45.34 milliseconds to execute. elapsed_msec=46
04-25-2022 11:45:25.829 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~53.74 milliseconds to execute. elapsed_msec=54
04-25-2022 11:45:25.882 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.27 milliseconds to execute. elapsed_msec=53
04-25-2022 11:45:25.924 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~41.69 milliseconds to execute. elapsed_msec=42
04-25-2022 11:45:25.976 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~52.32 milliseconds to execute. elapsed_msec=53
04-25-2022 11:45:26.032 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~55.64 milliseconds to execute. elapsed_msec=56
04-25-2022 11:45:26.084 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.54 milliseconds to execute. elapsed_msec=52
04-25-2022 11:45:26.136 +0200 INFO  ScriptedAuthHelper [503966 TcpChannelThread] - Function=getUserInfo took ~51.70 milliseconds to execute. elapsed_msec=52

 

 

Labels (1)
Labels
0 Karma
Reply

richgalloway
SplunkTrust
SplunkTrust
‎04-25-2022 05:32 AM

Did you set up Radius authentication on the indexers as well as the search heads?  That's not necessary and will lead to slow searches.  Only search heads need to authenticate.

---
If this reply helps you, Karma would be appreciated.
Reply

jonare
Engager
‎05-03-2022 03:26 AM

Thanks for reply and sorry for late answer from me !

You reply makes sense to me, I used the radius app from LukeMurphey.net to achieve autentication via radius.

Can I ask, how to I assign the autentication on indexes and search heads with this ?

Thanks in advance

0 Karma
Reply

richgalloway
SplunkTrust
SplunkTrust
‎05-03-2022 05:59 AM

As I mentioned in my earlier reply, do not configure authentication on indexers.  If you need to sign in to an indexer, use a local account.

After installing the Radius app on your search heads, use the setup page to configure it.  The app's splunkbase page has details.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...