Monitoring Splunk

What are the measures to check Splunk performance issue.


Hi Splunkers,

Good Day!

We have a multisite distributive environment in which we are experiencing performance issue like slowness while running Splunk reports, dashboards and ad-hoc searches in later half of the day, while it is running good in first half. We are looking to use Splunk as 24x7 but its like the first 12hrs it is running good but next 12hrs the performance gets degraded and gets worse.

Can you someone please tell what are the things/performance measures I can check in order to find the issue. One of the reason I believe is regular patching of servers during that hour. How can I investigate something from Splunk end?

Thanks in advance.

Tags (1)
0 Karma


Per George, an expert on Splunk multisite deployments at Rational Cyber, "It seems like their WAN is saturated by replication. They should look at queue fullness and at tcp out connections for replication."

0 Karma


Have you checked the DMC? There is lots of good info in there. Personally I would check search activity first.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>