Splunk Search

Which commands scale/distribute well

chris
Motivator

If I have a Splunk environment/installation that consists of at least one search head and multiple indexer installations is there an easy way to determine which commands perform well (and which commands do not)?

From the following technical paper I found out, that there is a map and a reduce part for every search:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf

I am assuming that streaming commands are the ones that can be run in parallel during the map part of the search:
http://docs.splunk.com/Splexicon:Streamingcommand

I am also assuming that in the Job inspector the "remoteSearch" part is the part of the search that can be run in parallel which is efficient:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

From experience I know, that the "stats" command can be a much better option (from performance perspective) than "transaction".

Is there any documentation with information about performance/internals about how the commands distribute?

Thanks
Chris

1 Solution

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

View solution in original post

Jason
Motivator

Any update on this? I thought I heard of some document improving on http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutthesearchlanguage#Types_of_search_com... recently.

0 Karma

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...