Splunk Search

Indexer performance hit, for searches with no results

jdunlea_splunk
Splunk Employee
Splunk Employee

I have a search like the following:

"index=index_A | "

If i distribute this to an indexer which does NOT have an index called index_A, what will be the performance issue with this? Will there be a significant/negligible hit on the indexer performance?

I ask, because what If I distributed 10,000 searches like this to an indexer, where only 100 out of the 10,000 would actually find the index they are looking for? - Would I still lock up the indexer from a performance point of view, even though 9,900 of the 10,000 searches cannot even find the index they are looking for on the indexer?

Any help here is appreciated!

John

0 Karma

woodcock
Esteemed Legend

Performance hit of the search is negligible because there will be no index on the indexer so the very first thing that is checked ( indexes.conf ) will fail. Such an approach should be fine from this aspect.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...