Different search performance for two sourcetype

[pradeepchhetri]

Hi,

We have a splunk machine running with all the events going to one index. I noticed that for two different sourcetype, I got different search performance. For one of the sourcetype, searching happened very quickly but it was very slow for the other. Can someone explain me why i am getting such a difference.

Regards.

[MuS · Accepted solution]

Hi pradeepchhetri,

This is the kind of question, that is almost impossible for anyone to answer, except to you - because you know your setup, know your events, know your server's load and so on.....

here are some basic troubleshooting things:

• do both sourcetypes have exactly the same event count over the exact same time range?
• is your search head / indexer over loaded?
• are there any saved searches running?
• check the job inspector to get any idea why one search is running slower as the other.

you see, there is a lot to check for you.

cheers, MuS

[pradeepchhetri]

@Mus: @martin_mueller: Just realized that the difference was due to fast-mode and smart-mode search types, although both has same number of events. Thank you for the help.

[martin_mueller]

I'm going to guess that production will have much more data than staging.

[pradeepchhetri]

@Mus: Thank you for the reply. I will do the troubleshooting accordingly and let you know the outcome.

[pradeepchhetri]

my search query just includes: sourcetype="production" and sourcetype="staging"

[splunker12er]

Can you post your search query ?