Monitoring Splunk

What are the measures to check Splunk performance issue.


Hi Splunkers,

Good Day!

We have a multisite distributive environment in which we are experiencing performance issue like slowness while running Splunk reports, dashboards and ad-hoc searches in later half of the day, while it is running good in first half. We are looking to use Splunk as 24x7 but its like the first 12hrs it is running good but next 12hrs the performance gets degraded and gets worse.

Can you someone please tell what are the things/performance measures I can check in order to find the issue. One of the reason I believe is regular patching of servers during that hour. How can I investigate something from Splunk end?

Thanks in advance.

Tags (1)
0 Karma


Per George, an expert on Splunk multisite deployments at Rational Cyber, "It seems like their WAN is saturated by replication. They should look at queue fullness and at tcp out connections for replication."

0 Karma


Have you checked the DMC? There is lots of good info in there. Personally I would check search activity first.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...