Indexer Capacity Planning - linking indexing and search performance: how does one effect the office?
I'm attempting to plan an upgrade of our Splunk instance from an ancient 6.4.1 to a brand new 7...
Hi,
My requirement is i need to pull more than 10 million data from database and index in splunk.
I want to understand, if this badly affects the performance of the stack, will there be any i...
...opulating with the new server name. For example the Monitoring Console-> Indexing-> IndexingPerformance: instance "Instance" Drop-down input box has the Old Server Name (only) and does not t...
Indexingperformance has started to become really bad to the point where my Splunk instance has stopped indexing events or at least appears to have stopped doing so. Restarting Splunk does not r...
...es yet, I wouldn't expect a noticeable performance impact. As I create additional indexes, performance seems to drop.
What could be causing this? This link suggests it's not the number of index...
I have an instance that I've set up to only run summary searches. Essentially, its a search head but no users connect directly to it and it only runs summary indexing searches.
I see a lot of t...
Currently, I have a combined instance where the search head and indexer are sitting on the same box. The documentation does indicate that performance improvements will be made by splitting that c...
I have one random searchhead that keeps showing up under the "IndexingPerformance by Instance" portion of the IndexingPerformance dashboard of the DMC. It says it has an inedxing rate of 0 kb/s....
Hi,
I have a search that will fetch about 5 GB of application logs. In order not to put load on the Splunk instance and slow search output, i am planning to use "Summary Indexing" using the new S...