Splunk Search

Detecting expensive searches in enterprise environment

smudge797
Path Finder

Is there a search I can run that will identify expensive searches across our enterprise environment? We are finding many searches that users have setup that are causing our indexers to grind to a near halt at certain times of the day.

Tags (1)
0 Karma

DaveSavage
Builder

Take a look at 'Splunk on Splunk' as a plug-in. It's a great tool. This extends the standard (which I assume you've already seen) stats in the Search > Status > Search Activity info. SoS shows you the issues whether disk related, paging and memory.
Good luck 😉

smudge797
Path Finder

Thanks Dave, Yes im familiar with SoS and use it often, i guess more specifically i want to identify real time searches and who is running them.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...