Is it known that disabled saved searches cause poor performance?

[bsizemore]

Hello, one of our engineers through trial and error discovered something that has been hobbling our Splunkfrastructure for months. We had 300 saved searches on one of our servers, 150 of which were disabled. He deleted all 150 disabled saved searches, and now our platform’s performance is orders of magnitude greater. Is this well known?

[bsizemore · Accepted solution]

Well, this was our experience.

[martin_mueller]

No skipped searches that I know of, rather sluggish UX... I'll check that nonetheless.

[bsizemore]

If you have piles of disabled saved searches, and you have numerous skipped searches, as we had, maybe you can try it an let us know how that works out. We are on 6.0.3.

[martin_mueller]

Ah... I wasn't thinking of a solution, just wondering if I should try this on some SHP environment that has become a bit sluggish lately 🙂

[bsizemore]

The host in question is an isolated job server. We do use pooling of search heads, which this host is not a member of.

[martin_mueller]

Are you using Search Head Pooling?