How are concurrent searches counted and how can we simulate 100 concurrent searches?

[andytanmc]

I would like to check if there is any possibility to simulate 100 concurrent search.

Also if I were to login 5 different account on a single PC and perform searches on every login does that equate to 5 concurrent searches?

Please advise.

[DalJeanis · Accepted solution]

@andytanmc, okay, @cusello gave you a simple and useful answer, but the more important context question is, what are you trying to achieve by simulating concurrent searches?

That strategy will spit out 100 searches, and your system will do whatever it is set up to do when one person submits 100 searches. If that tests your system as you want, then fine.

On the other hand, it may be more accurate to, for example, invent a single search that typically takes 5 minutes to complete, create 25 simple variations of that search that won't interact with each other, and set them each to run on a rolling scheduled basis every 5 minutes under 5 different IDs. (So ID 1 submits first search at minutes 1, 6, 11 etc and second search at minutes 2, 7, 12 etc), and there are always about 25 searches going. That gives you a "floor" of roughly 25 searches.

When that is working, pop up a dashboard with a different user running 25 searches, and see what happens.

[gcusello]

hi,
you could create a dashboard with 100 panels: when you load it Splunk executes your searches.

At the same time you can monitor your splunk system with DMC.

Bye.
Giuseppe