Hi,
We have a splunk machine running with all the events going to one index. I noticed that for two different sourcetype, I got different search performance. For one of the sourcetype, searching happened very quickly but it was very slow for the other. Can someone explain me why i am getting such a difference.
Regards.
Hi pradeepchhetri,
This is the kind of question, that is almost impossible for anyone to answer, except to you - because you know your setup, know your events, know your server's load and so on.....
here are some basic troubleshooting things:
you see, there is a lot to check for you.
cheers, MuS
Hi pradeepchhetri,
This is the kind of question, that is almost impossible for anyone to answer, except to you - because you know your setup, know your events, know your server's load and so on.....
here are some basic troubleshooting things:
you see, there is a lot to check for you.
cheers, MuS
@Mus: @martin_mueller: Just realized that the difference was due to fast-mode and smart-mode search types, although both has same number of events. Thank you for the help.
I'm going to guess that production
will have much more data than staging
.
@Mus: Thank you for the reply. I will do the troubleshooting accordingly and let you know the outcome.
my search query just includes: sourcetype="production" and sourcetype="staging"
Can you post your search query ?