Splunk Search

How can I improve configurations in Splunk so that searches run faster?

guillecasco
Path Finder

Simple queries are taking up to 15 or 20 seconds. I checked in Settings/distributed management console and the indexing rate is of 5.26 Kb/s. Is this a low parameter configuration? How can i improve or configure things on Splunk so searches don't take too much time? What other parameters i should take into account or modify in Splunk configuration?
I don't have access to Splunk server right now, i just have access to the Splunk Web interface with the admin account by the moment. Is there something i can do from here?
In overview, i'm also seeing: Splunk Enterprise Server 6.4.0
Linux, 3.68 GB Physical Memory, 1 CPU Cores
. Does this accomplish with the server requirements to run Splunk?

0 Karma

guillecasco
Path Finder

yes i have read this, also about the minimum hardware requirements, which i think it´s ok there. But also would like to know what should be the indexing rate? and how is related with the speed of searches.
is 5.26 Kb/s too slow? just slow? is normal?

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...