Python methods using ODBC to query users from a database table
Fresh install, very little data, only using "main" index
Only one custom role (not 60k roles)
Problems (while logged in as Administrator):
Getting to the role management page takes ~20 seconds to load. Same goes for saving any changes.
Bringing up the role management page (and users management page) kicks off 60k "getUserInfo" requests. Several complete per second but each time it's called, it's hitting my table. Why can't Splunk just call "getUsers" instead? This process won't finish for hours.
Problems (while logged in as a user from my database)
The default search app never finishes loading, therefore no searching can take place. The same goes for reports/dashboards. I don't get a timeout message and I've not added any search filters that would hide data from this user.
Why is Splunk choking on this authentication configuration? Would it run differently with 60k users under an LDAP configuration?