How to use ‘Field Perf Benchmark’ App

[jplaberge]

I just installed the ‘Field Perf Benchmark’ and I always have a ‘No results found’ in each pan of the App.

When I look at the search: ‘search index=_perf_report type=index metric=elaMinutes’ it talks about a index that I don’t have ‘_perf_report’.

What I’m doing wrong?

Thanks

[gfriedmann]

The major concept it took me a while to realize is that the benchmark app doesn't really apply to your current dataset. I think this the purpose of this app is to benchmark the OS and hardware performance level. (The readme.txt might benefit from a high-level what-this-does-and-why section. )

Here is my HOWTO i just worked out:

Configuring this app is hard unless you know what you are trying to accomplish.

I think the actual benchmark contains two tasks. The first is to read data off your disk (indexing). The next task is to query the data it just loaded into an index.

The location of data to index is specified in the /extraConfig/tasks.conf

Steps to make it go:

First you edit the app's tasks.conf to find your test data. Next you run the benchmark from CLI (as directed in the README.txt) which will restart splunk, index the configured data, search the data, and put the benchmark results into .log files. After this you can navigate to the app in splunk and hit "Search" to get some charts and graphs.

[V_at_Splunk]

Right, the Field Benchmark App needs to be configured with a specific dataset that you want to index, and then with any searches that you want to do. The dataset is indexed into one separate new index, and the reports are based on specially formatted data in another separate new index. We definitely did not want to pollute our customers' default index with test data or results.

[marcoscala]

V_at_Splunk, I tried to read the READMME file but's a bit disappointing. I couldn't get the idea underlying the app. Hera are some specific questions: 1) Tasks. Can you please explain what are "Tasks" as configured in task.conf? What's the difference between "Index" task and "Search" task?

2) is this app monitoring the standard Splunk indexer/Serach head workload or what?

Thanks a lot,

Marco

PS: I think the apps could be useful if we get it to work!

[V_at_Splunk]

Let's say you want to find out how fast does Splunk index /tmp/foo.dat; and then you want to time some searches on the resulting index. So then you specify these 2 tasks (index, and then search) in tasks.conf; when you install the app, tasks.conf just has example (dummy) tasks, to illustrate the syntax.

[V_at_Splunk]

To quote the app's description:

Merely downloading the app will do nothing. You will need to read and follow the instructions in SPLUNK_HOME/etc/apps/perftest/default/README.txt file.

If you still have questions, please ask them here. OK?    🙂