Splunk Search

Help regarding splunk queries ?


Hi Splunk members,

How Can I get some metrics to indicate things like search concurrency, search queue depth, cancelled/timed out searches, etc by search head and by indexer?

0 Karma


Hi splunker969,

have you read about the monitoring console http://docs.splunk.com/Documentation/Splunk/latest/DMC/DMCoverview yet?

cheers, MuS

0 Karma



You can try using metrics.log for various parameters.
Eg: index=_internal source=*metrics.log group=search_concurrency "system total" OR you can also use audit logs.

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...