Searches from our Enterprise Security search head seem to take a long time to handoff. How long?
15 -16 seconds.
Search is a simple "index=_internal earliest=-10m"
Splunk 6.1.6. Clustered indexers.
How many jobs do you have at the same time ? How many CPU do you have ?
This isnt an answer...
No, but with the lack of details you gave, it's not easy to give you a good answer !