Splunk Search

Is it possible to search Splunk for list of concurrent searches usage over time?

Motoko89
Path Finder

Hello, is it possible to search Splunk for list of concurrent searches usage over time by searching internal log?

Similar to this question for daily license usage:
https://answers.splunk.com/answers/68036/daily-license-usage-query.html

0 Karma

niketn
Legend

Refer to @somesoni2's answer for the same: https://answers.splunk.com/answers/381951/monitor-concurrent-searches.html

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adonio
Ultra Champion

or use the DMC (after 6.5.0 its called MC)

0 Karma

Richfez
SplunkTrust
SplunkTrust

Converted to answer, because I think it's an answer. 🙂

Also, perhaps to add to that just a tiny bit:

index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency earliest=-1w
| timechart max(active_hist_searches), max(active_realtime_searches)

Which will show the last week's worth. Do line chart.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...