Pivot loading splunk excessively ?

[agneticdk]

Hi

In the example in 6.0 on the audit log: Splunk's Internal Audit Logs - SAMPLE and looking on the pivot of "Audit" - Under the menu "Audit" in top right corner there is the Acceleration, Earliest and Started.

Earliest is when the splunk installation was done, because the data model is over "All time" (no earliest parameter defined). So thats a long way back. And now I can see the accelereation just chews away.

If I make my own data model without earliest paramter it will always take "All time" I guess.

I have to be very careful on my pivot datamodels, because if I create a few datamodels and grant access to those for lets say 10 people, when they start clicking around in the Pivot menus these acceleration searches will run for each user, on each table or chart ? Resulting in my search head and indexers doing a lot of work, as it will continue running until either the search times out or finishes on "All time", for each user ?

One way to limit this is to grant users only access to a limited timeframe, or by adding "earliest" to my datamodel.

Any comments ?

[Simon_Fishel · Accepted solution]

The acceleration searches should run only once for each user's session in the pivot interface, they do not need to be re-run for each table and chart that is created. And they should expire soon after each user stops using the pivot interface. I wouldn't expect the load on the search head to be much different than from 10 users running searches over all time in the search interface.

Another way to limit the load would be to accelerate the data model. Then all users of pivot are actually sharing the results of a single acceleration search.