Hi
Can anyone help me create a search in audittrail index to get the min/avg/max number of concurrent searches in a Splunk environment?
I would like to know how many searches are running concurrently in my environment, and use this info as capacity planning.
Thanks,
You can adjust the span
as appropriate
index=_internal source=*metrics.log group="search_concurrency" | timechart span=1h sum(active_hist_searches) as total | stats avg(total) min(total) max(total)
You could also explore the active_realtime_searches
field.
You can adjust the span
as appropriate
index=_internal source=*metrics.log group="search_concurrency" | timechart span=1h sum(active_hist_searches) as total | stats avg(total) min(total) max(total)
You could also explore the active_realtime_searches
field.
I downvoted this post because "sum(active_hist_searches)" doesn't have any real meaning. if i reported a million times in an hour that there was 1 active search, you would see 1 million searches as "total".
Should aggregation be "sum(active_hist_searches)" or "avg(active_hist_searches)" OR maybe max() ??