Splunk Dev

How are concurrent searches counted and how can we simulate 100 concurrent searches?

andytanmc
Engager

I would like to check if there is any possibility to simulate 100 concurrent search.

Also if I were to login 5 different account on a single PC and perform searches on every login does that equate to 5 concurrent searches?

Please advise.

0 Karma
1 Solution

DalJeanis
Legend

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

View solution in original post

DalJeanis
Legend

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

gcusello
SplunkTrust
SplunkTrust

hi,
you could create a dashboard with 100 panels: when you load it Splunk executes your searches.

At the same time you can monitor your splunk system with DMC.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...