Splunk Search

Is it possible to search Splunk for list of concurrent searches usage over time?

Motoko89
Path Finder

Hello, is it possible to search Splunk for list of concurrent searches usage over time by searching internal log?

Similar to this question for daily license usage:
https://answers.splunk.com/answers/68036/daily-license-usage-query.html

0 Karma

niketn
Legend

Refer to @somesoni2's answer for the same: https://answers.splunk.com/answers/381951/monitor-concurrent-searches.html

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adonio
Ultra Champion

or use the DMC (after 6.5.0 its called MC)

0 Karma

Richfez
SplunkTrust
SplunkTrust

Converted to answer, because I think it's an answer. 🙂

Also, perhaps to add to that just a tiny bit:

index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency earliest=-1w
| timechart max(active_hist_searches), max(active_realtime_searches)

Which will show the last week's worth. Do line chart.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...