Monitoring Splunk
Highlighted

Benchmarking search: indexer vs search head.

Splunk Employee
Splunk Employee

I've just setup a search head that will search across 2 load balanced indexers.  I'd like to compare the execution time of equivalent searches

 

1) when run on the new search head

2) when run our "old way" on the indexers themselves.

  Is there something I could use that tells me how long the search takes to execute?  Something maybe like the Splunk equivalent of the "time" command on Unix/Linux?

Highlighted

Re: Benchmarking search: indexer vs search head.

Splunk Employee
Splunk Employee

You can use the "inspect search" dialog which is available from the flashtimeline view "Actions" menu. If you pull the search results from the "jobs" page, it should pop into the flashtimeline view (usually) and you should be able to get to the menu item from there.

You can of course also use the unix time command with CLI searches.