Splunk Search

Benchmarking broken in Splunk search?

Administrator
Explorer

Hi,

 

the times splunk shows in "inspect job" are totally unrelated to reality:

 

This search has completed and has returned 11 results by scanning 18 events in 2.301 seconds

 

That's for a search which took 23 seconds to show up in the browser, which was also documented in "inspect job" by:

23.24 startup.handoff

 

The funny thing is, that splunk then can also show results after 3 seconds, but still have a startup.handoff of 20+ seconds. So it can be off by factor 10 in both directions, what's the use of that?

 

Regards

Arnim

0 Karma

Azeemering
Builder

How many peers have you got?

The startup.handoff amount of seconds is cumulative time from all involved peers.

From the documentation:

https://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/ViewsearchjobpropertieswiththeJobInspec...

startup.handoffThe time elapsed between the forking of a separate search process and the beginning of useful work of the forked search processes. In other words it is the approximate time it takes to build the search apparatus. This is cumulative across all involved peers. If this takes a long time, it could be indicative of I/O issues with .conf files or the dispatch directory.

 

0 Karma

Administrator
Explorer

Don't know how many peers there are, how can I find it out? Anyway not enough because today the server is just showing "Server error" after each request :disappointed_face:

 

Obviously some admins weren't able to set it up properly, they should take some classes from splunk education.

 

Btw, the servers name is elearninglab1.class.splunk.com :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...