Splunk Search

When performing a search splunk web freezes the browser tab and facing performance issue when searching ?

Hemnaath
Motivator

Hi All,

One of the user is facing an performance issue while performing the searches and also the splunk web freezes the browser. User had tried accessing the splunk web from different machine and multiple browser.

We have 3 search head cluster environment with splunk 6.6.1 version.

Question:
How / from where to check the error, specific to this user account and review the performance impact for last 30 days.
How to trouble shoot this issue.

Kindly guide me on this.

0 Karma

dkolekar_splunk
Splunk Employee
Splunk Employee
  1. Check the search query, the user is using to run the search.
  2. If it is a particular SPL is causing the issue, you may need to check the knowledge object and their permissions used in the search query.
  3. Use search artifacts to narrow down the issue. Check search.log and in parallel splunkd.log
  4. Check the job inspector to see where the search is taking a too long time
  5. Using DMC, you can check how many expensive searches a particular user is running. You may need to optimize that.

somesoni2
SplunkTrust
SplunkTrust
0 Karma

Hemnaath
Motivator

Hi Somesoni2, thanks for working on this issue, hey I could see the following error details in the splunkd.log for this particular user who is facing the issue. When checked for a period of last 30 days we could see the below error occurring on and off. Similarly when checked in metrics.log and splunkd_ui_access could not see any error.

Splunkd.log
ERROR AuthenticationManagerLDAP - Couldn't find matching groups for user="user500". Search filter="(&(uniquemember=uid=user500,ou=internal,ou=users,dc=test,dc=com)(cn=Splunk_Admin))" strategy="test LDAP"

So could you please guide me how to fix this issue.
thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...