Splunk Search

Which commands scale/distribute well

chris
Motivator

If I have a Splunk environment/installation that consists of at least one search head and multiple indexer installations is there an easy way to determine which commands perform well (and which commands do not)?

From the following technical paper I found out, that there is a map and a reduce part for every search:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf

I am assuming that streaming commands are the ones that can be run in parallel during the map part of the search:
http://docs.splunk.com/Splexicon:Streamingcommand

I am also assuming that in the Job inspector the "remoteSearch" part is the part of the search that can be run in parallel which is efficient:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

From experience I know, that the "stats" command can be a much better option (from performance perspective) than "transaction".

Is there any documentation with information about performance/internals about how the commands distribute?

Thanks
Chris

1 Solution

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

View solution in original post

Jason
Motivator

Any update on this? I thought I heard of some document improving on http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutthesearchlanguage#Types_of_search_com... recently.

0 Karma

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...