I have around 10 SH's in my production setup.A load balancer is used to redirect User to any of those search heads.
many users are complaining about UI timing out. Is there a way i can track these timeouts in splunk internal logs?
you can use the S.o.S. App for this, there is a nice view about the HTTP response time of splunkd
here is the URL for the view /en-US/app/sos/performance_splunkd_http
Or you search in $SPLUNK_HOME/var/log/splunk/splunkd_access.log this is were splunkd records the HTTP access logs.
hope this helps ...
View solution in original post