Dashboards & Visualizations

Configuration initialization for /opt/splunk/etc took longer than expected in Splunk. Indicates storage performance.

mayankrojo
Explorer

Hello All,

I have a question. I am getting the below warning on all the panels of my dashboard. Also, the search is taking a lot of time to execute.

Configuration initialization for /opt/splunk/etc took longer than expected (1953ms) when dispatching a search with search ID _bWFkaHVyaS5tYXlhbmtAcm9qb2NvbnN1bHRhbmN5LmNvbQ_bWFkaHVyaS5tYXlhbmtAcm9qb2NvbnN1bHRhbmN5LmNvbQ__search__search1_1598863806.484277. This usually indicates problems with underlying storage performance.

I checked with the disk usage and CPU utilization but that is not an issue here. 

I am on version Splunk 7.2.4 (build 8a94541dcfac)

Can you please help me to troubleshoot this and how can I get this solved.

Thanks,

Madhuri

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mayankrojo,

I have sometimes this message on my pc.

You have to check the IOPS of you storage, Splunk requires at least 800 IOPS and this is usually the Splunk bottleneck.

CPUs aren't relevant.

You can check IOPSs using a tool like Bonnie++ that you can find on Internet.

It's also useful to reduce the number of fields of your searches: in other words, if for your output are relevant only _time, field1, field2, field3 and field4, but you have in your data many other fields, you could insert, after the main search the command:

| fields _time field1 field2 field3 field4

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...