When performing a search splunk web freezes the browser tab and facing performance issue when searching ?

[Hemnaath]

Hi All,

One of the user is facing an performance issue while performing the searches and also the splunk web freezes the browser. User had tried accessing the splunk web from different machine and multiple browser.

We have 3 search head cluster environment with splunk 6.6.1 version.

Question:
How / from where to check the error, specific to this user account and review the performance impact for last 30 days.
How to trouble shoot this issue.

Kindly guide me on this.

[dkolekar_splunk]

1. Check the search query, the user is using to run the search.
2. If it is a particular SPL is causing the issue, you may need to check the knowledge object and their permissions used in the search query.
3. Use search artifacts to narrow down the issue. Check search.log and in parallel splunkd.log
4. Check the job inspector to see where the search is taking a too long time
5. Using DMC, you can check how many expensive searches a particular user is running. You may need to optimize that.

[somesoni2]

I would start here (general troubleshooting steps):
https://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/ViewdistsearchstatusinDMC

[Hemnaath]

Hi Somesoni2, thanks for working on this issue, hey I could see the following error details in the splunkd.log for this particular user who is facing the issue. When checked for a period of last 30 days we could see the below error occurring on and off. Similarly when checked in metrics.log and splunkd_ui_access could not see any error.

Splunkd.log
ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="user500". Search filter="(&(uniquemember=uid=user500,ou=internal,ou=users,dc=test,dc=com)(cn=Splunk_Admin))" strategy="test LDAP"

So could you please guide me how to fix this issue.
thanks in advance.