Building for the Splunk Platform

Loadjob performance: sid is faster than "user:app:search name"


We have a search head cluster with 8 search head nodes ( captain was set to ad-hoc search only), and replication factor is 2 , we use schedule search to grant user access to the data they need instead of granting user access to index. This method is working for access control , but we are facing performance issue because of the huge amount of artifact(more than 10 thousands of artifact in the cluster). The loadjob command will run 30-40s even if  the saved search only has 1 event ,  we checked the job inspector and found the most of time was spent on loadjob command.

Drilling down to the detail log, the most of time were likely spent on finding the artifact according to the owner,app and search name and pull the artifact from the search head it's stored. Then we try to use sid instead in the loadjob command, it's really faster than using "owner:app:search name", runtime is less than 1 second.

Do you know the difference between using sid and "owner:app:search name" ?



Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...