Tuning ES to environment


How are you tuning ES to your environment? 

Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies?

When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed?

What about ES Content Updates?

Labels (1)
0 Karma


Hi @wgawhh5hbnht,

tuning an ES environment isn't a job to ask in Community but it requires Splunk Professional Services or at least a Training on ES Administration!

Anyway, the most important tuning is to see if there are problems on resources when Scheduled Searches are executed; then you have to see if there are queues in Indexing.

You can check all using the Splunk Monitoring Console.

About the other questions:

  • make always a copy of Correlation Searches and modify them,
  • updates in Correlation Searches are always documented in the Release Notes, so you don't need to check them row by row, but you can see the release notes,
  • ES Content Updates are other Use Cases already available for the users.



Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...