Installation

dbquery run slower after upgrade to splunk 7.0 from 6.4.1

sylim_splunk
Splunk Employee
Splunk Employee

When comparing runtime of dbquery between splunk 7.0.0 and splunk 6.4.1 the query with 7.0 takes slightly longer than that with 6.4.1. This is not a critical issue but want to know why.

Job Inspector shows like below - as you can find splunk 6.4 has less entries.

From Splunk 7.0.0 + db_connect 3.1.2
Duration (seconds) Component Invocations Input count Output count
1.52 command.dbxquery 1 - 13
0.00 dispatch.check_disk_usage 1 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.68 dispatch.evaluate 1 - -
0.68 dispatch.evaluate.dbxquery 1 - -
0.00 dispatch.evaluate.noop 1 - -
0.68 dispatch.optimize.FinalEval 1 - -
0.65 dispatch.optimize.matchReportAcceleration 1 - -
0.02 dispatch.optimize.optimization 1 - -
0.02 dispatch.optimize.reparse 1 - -
0.73 dispatch.optimize.toJson 1 - -
0.00 dispatch.optimize.toSpl 1 - -
0.01 dispatch.writeStatus 7 - -
0.03 startup.configuration 1 - -
0.06 startup.handoff 1 - -

From Splunk 6.4.1 + 3.1.2
1.88 command.dbxquery 1 - 13
0.00 dispatch.check_disk_usage 1 - -
0.00 dispatch.createdSearchResultInfrastructure 1 - -
0.69 dispatch.evaluate 1 - -
0.69 dispatch.evaluate.dbxquery 1 - -
0.01 dispatch.writeStatus 6 - -
0.03 startup.configuration 1 - -
0.06 startup.handoff 1 - -

Tags (1)
0 Karma
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

As you can see, those entries are from search optimization feature which was just introduced to 6.5. This just kicks in before it actually start search. The symptom disappears after it disabled as suggested in the link below and performance wise it worked well as expected. It's not something we should disable but it worked for the case.

In $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/limits.conf
[search_optimization]
enabled=false

You can find more information from the documentation;
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...

View solution in original post

0 Karma

sylim_splunk
Splunk Employee
Splunk Employee

As you can see, those entries are from search optimization feature which was just introduced to 6.5. This just kicks in before it actually start search. The symptom disappears after it disabled as suggested in the link below and performance wise it worked well as expected. It's not something we should disable but it worked for the case.

In $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/limits.conf
[search_optimization]
enabled=false

You can find more information from the documentation;
http://docs.splunk.com/Documentation/Splunk/latest/Search/Built-inoptimization#Turn_off_optimization...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...