Splunk Dev

How are concurrent searches counted and how can we simulate 100 concurrent searches?

andytanmc
Engager

I would like to check if there is any possibility to simulate 100 concurrent search.

Also if I were to login 5 different account on a single PC and perform searches on every login does that equate to 5 concurrent searches?

Please advise.

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

gcusello
SplunkTrust
SplunkTrust

hi,
you could create a dashboard with 100 panels: when you load it Splunk executes your searches.

At the same time you can monitor your splunk system with DMC.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...