Monitoring Splunk

How to use ‘Field Perf Benchmark’ App

jplaberge
Engager

I just installed the ‘Field Perf Benchmark’ and I always have a ‘No results found’ in each pan of the App.

When I look at the search: ‘search index=_perf_report type=index metric=elaMinutes’ it talks about a index that I don’t have ‘_perf_report’.

What I’m doing wrong?

Thanks

Tags (2)

gfriedmann
Communicator

The major concept it took me a while to realize is that the benchmark app doesn't really apply to your current dataset. I think this the purpose of this app is to benchmark the OS and hardware performance level. (The readme.txt might benefit from a high-level what-this-does-and-why section. )

Here is my HOWTO i just worked out:

Configuring this app is hard unless you know what you are trying to accomplish.

I think the actual benchmark contains two tasks. The first is to read data off your disk (indexing). The next task is to query the data it just loaded into an index.

The location of data to index is specified in the /extraConfig/tasks.conf

Steps to make it go:

First you edit the app's tasks.conf to find your test data. Next you run the benchmark from CLI (as directed in the README.txt) which will restart splunk, index the configured data, search the data, and put the benchmark results into .log files. After this you can navigate to the app in splunk and hit "Search" to get some charts and graphs.

V_at_Splunk
Splunk Employee
Splunk Employee

Right, the Field Benchmark App needs to be configured with a specific dataset that you want to index, and then with any searches that you want to do. The dataset is indexed into one separate new index, and the reports are based on specially formatted data in another separate new index. We definitely did not want to pollute our customers' default index with test data or results.

0 Karma

marcoscala
Builder

V_at_Splunk, I tried to read the READMME file but's a bit disappointing. I couldn't get the idea underlying the app. Hera are some specific questions: 1) Tasks. Can you please explain what are "Tasks" as configured in task.conf? What's the difference between "Index" task and "Search" task?

2) is this app monitoring the standard Splunk indexer/Serach head workload or what?

Thanks a lot,

Marco

PS: I think the apps could be useful if we get it to work!

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

Let's say you want to find out how fast does Splunk index /tmp/foo.dat; and then you want to time some searches on the resulting index. So then you specify these 2 tasks (index, and then search) in tasks.conf; when you install the app, tasks.conf just has example (dummy) tasks, to illustrate the syntax.

0 Karma

V_at_Splunk
Splunk Employee
Splunk Employee

To quote the app's description:

Merely downloading the app will do nothing. You will need to read and follow the instructions in SPLUNK_HOME/etc/apps/perftest/default/README.txt file.

If you still have questions, please ask them here. OK?    🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...