Monitoring Splunk

How to monitor search activity on Indexers

richnavis
Contributor

Our Topology consists of pooled search heads all pointing to 3 search peers. How can I determine the concurrent search activity on each search peer? I know how to find out which search heads the searches are coming from, but how can I figure out which indexers are returning the results from these searches. I

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

For the search concurrency look at index=_audit

To know which indexer replied, this is not available, you could just get the know the search time per search-peer using the search inspector (but those logs are not indexed, they exists only on the SH in the dispatch folder in the search artifact)

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...