Benchmarking broken in Splunk search?

[Administrator]

Hi,

the times splunk shows in "inspect job" are totally unrelated to reality:

This search has completed and has returned 11 results by scanning 18 events in 2.301 seconds

That's for a search which took 23 seconds to show up in the browser, which was also documented in "inspect job" by:

23.24 startup.handoff

The funny thing is, that splunk then can also show results after 3 seconds, but still have a startup.handoff of 20+ seconds. So it can be off by factor 10 in both directions, what's the use of that?

Regards

Arnim

[Azeemering]

How many peers have you got?

The startup.handoff amount of seconds is cumulative time from all involved peers.

From the documentation:

https://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/ViewsearchjobpropertieswiththeJobInspec...

startup.handoff

The time elapsed between the forking of a separate search process and the beginning of useful work of the forked search processes. In other words it is the approximate time it takes to build the search apparatus. This is cumulative across all involved peers. If this takes a long time, it could be indicative of I/O issues with .conf files or the dispatch directory.

[Administrator]

Don't know how many peers there are, how can I find it out? Anyway not enough because today the server is just showing "Server error" after each request 😞

Obviously some admins weren't able to set it up properly, they should take some classes from splunk education.

Btw, the servers name is elearninglab1.class.splunk.com 😉