Splunk Dev

How are concurrent searches counted and how can we simulate 100 concurrent searches?

andytanmc
Engager

I would like to check if there is any possibility to simulate 100 concurrent search.

Also if I were to login 5 different account on a single PC and perform searches on every login does that equate to 5 concurrent searches?

Please advise.

0 Karma
1 Solution

DalJeanis
Legend

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

View solution in original post

DalJeanis
Legend

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

gcusello
SplunkTrust
SplunkTrust

hi,
you could create a dashboard with 100 panels: when you load it Splunk executes your searches.

At the same time you can monitor your splunk system with DMC.

Bye.
Giuseppe

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...