Monitoring Splunk

How to monitor search activity on Indexers

richnavis
Contributor

Our Topology consists of pooled search heads all pointing to 3 search peers. How can I determine the concurrent search activity on each search peer? I know how to find out which search heads the searches are coming from, but how can I figure out which indexers are returning the results from these searches. I

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

For the search concurrency look at index=_audit

To know which indexer replied, this is not available, you could just get the know the search time per search-peer using the search inspector (but those logs are not indexed, they exists only on the SH in the dispatch folder in the search artifact)

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...