Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
4,000 results
Sorted by:
10-07-2019
03:00 AM
Hi, Splunkers:
About a week ago, a customer asked me that is there a reference for deployment server which has 1200+ client?
They have the high speed LAN but not sure about CPU and Memory shoul...
01-16-2020
09:36 AM
1 Karma
...,3}\.\d{1,3}\.\d{1,3}\.\d{1,3},\s+on\s+dev\s\w+\n.+
Is this overkill for performance purposes and would it even work? I have read that the more detailed the regex, the better it would perform and s...
02-20-2021
08:11 AM
Hi I need to calculate a sum of different counters from several sourcetypes. They are located in one index, but simple operations give no results for some reason when counters are taken from differe...
03-03-2020
10:26 PM
I have a data feed to Splunk that contains number, state and service name.
This comes in to Splunk continuously as the state/service name changes. (number would stay the same as it is the key field...
05-25-2012
06:57 AM
1 Karma
Is there any way to predetermine what performance to expect from Splunk?
We have just installed Splunk, distributed on two indexers, one of them is also a search head.
What search performance c...
- Tags:
- performance
Show results in replies (4)
-
Thanks. I'm waiting for some performance tests. The 8 data drives are all in one set (see update a...
-
that's seems like pretty good performance. but the number of results per second/per minute does d...
-
Well, the answer to any performance question is often "it depends". But, I would make some c...
-
...ee that the disks are performing within spec, and that searches are within what we reasonably e...
03-08-2012
02:11 PM
1 Karma
Is Splunk performance better with Raid 1+0 configured across as many spindles as possible, sharing with the OS -- or use separate partitions for Splunk and the OS and/or swap file?
03-28-2017
02:44 AM
Hello All !
I ask myself what is the best approach to extract all fields of logs with regex in general.
I speak here of Search Time Extraction.
Is it better for performance to write 1 BIG r...
Show results in replies (4)
-
...uggest ([^,]+), as a building block instead of (.+?), , just as a general practice. The performance will p...
-
...vent once. Why not try both, use the job inspector to view the performance numbers, and report back?
-
...egex for either, see https://answers.splunk.com/answers/10945/performance-of-extract-vs-report-for-s...
-
...ndexers for every event (whereas if you have a search-time field extraction, you take a performance hit o...
10-12-2019
03:28 PM
...nputs.conf
1) Do we need to do anything for our splunk clients to pick up changes?
2) In terms of performance, and syntax does anyone have any concerns or recommendations to improve the performance o...
06-19-2020
07:49 AM
Here is a sample of my log: {
NIC: {
eth2: {
linkSpeedInKbps: 10000000
macAddress: XX:XX:XX:XX:XX:XX
name: eth2
stats: {
network.dropped_...
Labels
- Labels:
-
chart
05-19-2013
06:41 PM
We have a search that is spending most of its time in command.search.kv. If we give it a search which doesn't need any fields, like:
index=myindex sourcetype=mytype | stats count
it takes 1...
- Tags:
- search-efficiency
