Building for the Splunk Platform

Loadjob performance: sid is faster than "user:app:search name"


We have a search head cluster with 8 search head nodes ( captain was set to ad-hoc search only), and replication factor is 2 , we use schedule search to grant user access to the data they need instead of granting user access to index. This method is working for access control , but we are facing performance issue because of the huge amount of artifact(more than 10 thousands of artifact in the cluster). The loadjob command will run 30-40s even if  the saved search only has 1 event ,  we checked the job inspector and found the most of time was spent on loadjob command.

Drilling down to the detail log, the most of time were likely spent on finding the artifact according to the owner,app and search name and pull the artifact from the search head it's stored. Then we try to use sid instead in the loadjob command, it's really faster than using "owner:app:search name", runtime is less than 1 second.

Do you know the difference between using sid and "owner:app:search name" ?



Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...