Splunk Search

How can I improve configurations in Splunk so that searches run faster?

guillecasco
Path Finder

Simple queries are taking up to 15 or 20 seconds. I checked in Settings/distributed management console and the indexing rate is of 5.26 Kb/s. Is this a low parameter configuration? How can i improve or configure things on Splunk so searches don't take too much time? What other parameters i should take into account or modify in Splunk configuration?
I don't have access to Splunk server right now, i just have access to the Splunk Web interface with the admin account by the moment. Is there something i can do from here?
In overview, i'm also seeing: Splunk Enterprise Server 6.4.0
Linux, 3.68 GB Physical Memory, 1 CPU Cores
. Does this accomplish with the server requirements to run Splunk?

0 Karma

guillecasco
Path Finder

yes i have read this, also about the minimum hardware requirements, which i think it´s ok there. But also would like to know what should be the indexing rate? and how is related with the speed of searches.
is 5.26 Kb/s too slow? just slow? is normal?

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...