Splunk Cloud Platform

Is it possible to change the default search performance to "high_perf" in splunkcloud?

jackjack
Path Finder

Is it possible to change the default search performance to "high_perf" in splunkcloud?

On splunkcloud in the search bar you have the option of setting search performance to: standard_perf (search default), limited_perf, high_perf or Policy-Based Pool.

I have begun using high_perf for my queries since otherwise things are WAY too slow. However it constantly changes me back to the default standard_perf. I cannot find the setting for this anywhere and have had no luck searching for documentation either.

 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The recommended method of workload pool assignment is automatic assignment by workload rules.

You can override this seting manually by selecting specific workload pool when creating a scheduled report or summary acceleration but the recommended waymof managing workload assignment is by workload rules.

So if you want to change workload assignment policy, you have to edit your workload assignment rules

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2101/Admin/WorkloadManagement

jackjack
Path Finder

Thank you for linking that. Looks like I'll need to spend a bit of time understanding how to optimize everything. Unfortunately I won't have time to dive deep on the optimization work for a bit.

Do you happen to know how to change the search default for ad-hoc searches (like when I'm trying a new query out) with that system? 

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...