Deployment Architecture

Identifying bottlenecks on indexers and search head


Hi all,

I've been tasked with detailing information about our Splunk indexer and search head machines that shows the need for increased machine performance. I know our instance of Splunk is "slow" multiple times throughout the day. Moreover, I know that the machines do not meet the recommended hardware requirements. Regardless, I need to display this information to the best of my ability.

In order to relay this information, I want to use Splunk on Splunk in order to show what happens to our indexers and search head when under heavy load. Does anyone have some good recommendations for how to objectively display this information using S.o.S.?


Tags (3)
0 Karma


You don't mention which platform you are running on, but this sounds like a sysadmin/resource issue, not an application issue. If you are running on Linux or unix, I would recommending using the "sar" utilities to profile machine resource usage over time across your Splunk infrastructure. This will give you a starting view of the resources being used and should indicate where they are maxing out, be that processor, memory, or i/o. From that you can then work back to understanding the processes, and the causes of the resource exhaustion.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...