Splunk Dev

How are concurrent searches counted and how can we simulate 100 concurrent searches?

andytanmc
Engager

I would like to check if there is any possibility to simulate 100 concurrent search.

Also if I were to login 5 different account on a single PC and perform searches on every login does that equate to 5 concurrent searches?

Please advise.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

gcusello
SplunkTrust
SplunkTrust

hi,
you could create a dashboard with 100 panels: when you load it Splunk executes your searches.

At the same time you can monitor your splunk system with DMC.

Bye.
Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...