Splunk Search

Indexer performance hit, for searches with no results

jdunlea_splunk
Splunk Employee
Splunk Employee

I have a search like the following:

"index=index_A | "

If i distribute this to an indexer which does NOT have an index called index_A, what will be the performance issue with this? Will there be a significant/negligible hit on the indexer performance?

I ask, because what If I distributed 10,000 searches like this to an indexer, where only 100 out of the 10,000 would actually find the index they are looking for? - Would I still lock up the indexer from a performance point of view, even though 9,900 of the 10,000 searches cannot even find the index they are looking for on the indexer?

Any help here is appreciated!

John

0 Karma

woodcock
Esteemed Legend

Performance hit of the search is negligible because there will be no index on the indexer so the very first thing that is checked ( indexes.conf ) will fail. Such an approach should be fine from this aspect.

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...