Monitoring Splunk

Monitor Concurrent Searches

aferone
Builder

Every once in a while, we will get this message, and I understand it.

I would like to run a periodic search, add it to a summary index, and chart against it so that I can see when it happens historically.

I have read through some of the answers here, but I am wondering if there is just a Splunk search that will spit out the number of concurrent searches happening at that time. Does that exist? Since the error shows a number, I am assuming it is possible?

Thanks!

alt text

Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" 
        | timechart max(active_hist_searches) as "Historical Searches" min(active_realtime_searches) as "Real-time Searches" by host
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...