Deployment Architecture

[Performance] What does exactly an indexer and a search head during a search ?

olivier_ma
Explorer

Hello,

I currently meet some performance issue during my search (for instance, one of my search takes 75 hours with multiple sub-search for correlation). So I'm looking for some performance improvement.

That's why I try to find the exact task allocation between an indexer and a search head when we run a search on Splunk.
Let's take an example that can help you to explain me :
index=a field_1=b | eval field_2=lower(field_1) | lookup l_1 field_2 OUTPUT field_3

Also inline fields extraction is done on indexer side or search head ?

Thanks,

Tags (1)
0 Karma

jensonthottian
Contributor

I think a summary index would be a good idea to retrieve results faster.
http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Usesummaryindexing

This should help you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...