Monitoring Splunk

How to use ‘Field Perf Benchmark’ App


I just installed the ‘Field Perf Benchmark’ and I always have a ‘No results found’ in each pan of the App.

When I look at the search: ‘search index=_perf_report type=index metric=elaMinutes’ it talks about a index that I don’t have ‘_perf_report’.

What I’m doing wrong?


Tags (2)


The major concept it took me a while to realize is that the benchmark app doesn't really apply to your current dataset. I think this the purpose of this app is to benchmark the OS and hardware performance level. (The readme.txt might benefit from a high-level what-this-does-and-why section. )

Here is my HOWTO i just worked out:

Configuring this app is hard unless you know what you are trying to accomplish.

I think the actual benchmark contains two tasks. The first is to read data off your disk (indexing). The next task is to query the data it just loaded into an index.

The location of data to index is specified in the /extraConfig/tasks.conf

Steps to make it go:

First you edit the app's tasks.conf to find your test data. Next you run the benchmark from CLI (as directed in the README.txt) which will restart splunk, index the configured data, search the data, and put the benchmark results into .log files. After this you can navigate to the app in splunk and hit "Search" to get some charts and graphs.

Splunk Employee
Splunk Employee

Right, the Field Benchmark App needs to be configured with a specific dataset that you want to index, and then with any searches that you want to do. The dataset is indexed into one separate new index, and the reports are based on specially formatted data in another separate new index. We definitely did not want to pollute our customers' default index with test data or results.

0 Karma


V_at_Splunk, I tried to read the READMME file but's a bit disappointing. I couldn't get the idea underlying the app. Hera are some specific questions: 1) Tasks. Can you please explain what are "Tasks" as configured in task.conf? What's the difference between "Index" task and "Search" task?

2) is this app monitoring the standard Splunk indexer/Serach head workload or what?

Thanks a lot,


PS: I think the apps could be useful if we get it to work!

0 Karma

Splunk Employee
Splunk Employee

Let's say you want to find out how fast does Splunk index /tmp/foo.dat; and then you want to time some searches on the resulting index. So then you specify these 2 tasks (index, and then search) in tasks.conf; when you install the app, tasks.conf just has example (dummy) tasks, to illustrate the syntax.

0 Karma

Splunk Employee
Splunk Employee

To quote the app's description:

Merely downloading the app will do nothing. You will need to read and follow the instructions in SPLUNK_HOME/etc/apps/perftest/default/README.txt file.

If you still have questions, please ask them here. OK?    🙂

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...