Tuning ES to environment

[wgawhh5hbnht]

How are you tuning ES to your environment? 

Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies?

When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed?

What about ES Content Updates?

[gcusello]

Hi @wgawhh5hbnht,

tuning an ES environment isn't a job to ask in Community but it requires Splunk Professional Services or at least a Training on ES Administration!

Anyway, the most important tuning is to see if there are problems on resources when Scheduled Searches are executed; then you have to see if there are queues in Indexing.

You can check all using the Splunk Monitoring Console.

About the other questions:

• make always a copy of Correlation Searches and modify them,
• updates in Correlation Searches are always documented in the Release Notes, so you don't need to check them row by row, but you can see the release notes,
• ES Content Updates are other Use Cases already available for the users.

Ciao.

Giuseppe