Monitoring Splunk

How do I make a report that compares search performance after reconfiguration?

sectrainingjk
Explorer

Earlier today, we changed the searching (peer config) so that our search heads will only perform searches across 4 physical indexers.

We did this in an attempt to reduce what we think are issues with some indexer instances on virtual machines.

What report can I run that will best highlight performance for searches, comparatively? My head's awash in Indexing Performance vs Search Activity vs Search Usage, and I keep sliding down rabbit holes. And no, we didn't do the reconfig based on another report, nor did we baseline anything to work off of, report-wise. 😞

0 Karma

adonio
Ultra Champion

if you have a saved search that was working for a while, you can quickly check performance leveraging the _audit index
something like this will tell you how long it took the search to run over time.

 index = _audit duration savedsearch_name="SearchNameHere" 
    | timechart span=15m avg(total_run_time) as total_run

if you removed indexer yesterday, try and run it for the last 3 days or so.

hope it helps

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...