Monitoring Splunk

How to monitor search activity on Indexers

richnavis
Contributor

Our Topology consists of pooled search heads all pointing to 3 search peers. How can I determine the concurrent search activity on each search peer? I know how to find out which search heads the searches are coming from, but how can I figure out which indexers are returning the results from these searches. I

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

For the search concurrency look at index=_audit

To know which indexer replied, this is not available, you could just get the know the search time per search-peer using the search inspector (but those logs are not indexed, they exists only on the SH in the dispatch folder in the search artifact)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...