How search how many concurrent searches (adhoc, report, summary, etc) are running at the same time in my environment?

[melonman]

Hi

Can anyone help me create a search in audittrail index to get the min/avg/max number of concurrent searches in a Splunk environment?
I would like to know how many searches are running concurrently in my environment, and use this info as capacity planning.

Thanks,

[sundareshr · Accepted solution]

You can adjust the span as appropriate

index=_internal source=*metrics.log group="search_concurrency" | timechart span=1h sum(active_hist_searches) as total | stats avg(total) min(total) max(total)

You could also explore the active_realtime_searches field.

[landen99]

I downvoted this post because "sum(active_hist_searches)" doesn't have any real meaning. if i reported a million times in an hour that there was 1 active search, you would see 1 million searches as "total".

[melonman]

Should aggregation be "sum(active_hist_searches)" or "avg(active_hist_searches)" OR maybe max() ??