Why does the startup.handoff for searches from our Splunk App for Enterprise Security search head seem to take a long time?

[madcitygeek]

Searches from our Enterprise Security search head seem to take a long time to handoff. How long?

15 -16 seconds.

Search is a simple "index=_internal earliest=-10m"

Splunk 6.1.6. Clustered indexers.

[mdessus_splunk]

How many jobs do you have at the same time ? How many CPU do you have ?

[pj]

This isnt an answer...

[mdessus_splunk]

No, but with the lack of details you gave, it's not easy to give you a good answer !