I have one random searchhead that keeps showing up under the "IndexingPerformance by Instance" portion of theIndexingPerformance dashboard of theDMC. It says it has an inedxing rate of 0 kb/s....
I want toindexthe dynamic performanceviews that are available in SYS of Oracle Database on Splunk. These views include SYS.V_$TRANSACTION, SYS.V_$SESSION and so on.
The advantage of indexingthe...
I've taken over managing two Splunk environments a while back, one in a Test environment and another in a Prod environment. Was looking through theDMC in Indexer Performance and noticed that theindex...
What's the general consensus / best practice when looking in theDMC --> Indexing --> IndexingPerformance: Instance, looking at the "Fill Ratio of Data Processing Queues" - Which aggregation i...
Hi,
we recently installed new indexer servers to help the existing indexer servers that were under heavy load. The new servers are newer and have more cpus/ram. It might not be a good idea to m...
I'm planning to introduce index parallelization into our Splunk deployment given the additional resources we have on our indexers. In looking at theDMC, specifically under IndexingPerformance, I d...
How can I measure performance of Splunk about indexing events.
I want to increase MAX_TIMESTAMP_LOOKAHEAD for the event. I can directly see that doing this would decrease performance, but I want to...
...the upgrade? And how to fix it? I tried to search through Splunk Community, google around, but did not find anything useful... Thanks in advance. Lukas Mecir
I was wondering what theperformance impact is on theindexers when lines are being truncated. I have noticed that recently there have been several events coming in from one of my larger clients t...