Getting Data In

Is it possible to check sed performance in props.conf?

sc0tt
Builder

Is there a way to test the performance of sed scripts running in props.conf? I'm not an expert in regular expressions so I want to make sure that I'm not creating bottlenecks when indexing events. Events are < 1000 characters.

Thanks.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can see sed- and regex-related load during indexing by grabbing the SoS app from http://apps.splunk.com/app/748/ and opening the Indexing Performance view. A screen or two down you'll see index load by processes, you're looking for the regexprocessor.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can see sed- and regex-related load during indexing by grabbing the SoS app from http://apps.splunk.com/app/748/ and opening the Indexing Performance view. A screen or two down you'll see index load by processes, you're looking for the regexprocessor.

martin_mueller
SplunkTrust
SplunkTrust

Just install the app, it's free and has literally hundreds of other benefits.

If for some reason you seriously cannot install it you can download it, unpack, and grab the search behind the graph manually. It's basically extracting information from the _internal index, so you can run the query without the app.

0 Karma

sc0tt
Builder

Great info! Is there an example of creating this report with without installing the app?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...