Monitoring Splunk

Role "restrict search terms" Performance Issue

behymejt2012
Path Finder

Hi Everyone,

Looks for a few best practices or suggestions. I have installed search term restrictions based on a users role. All my dashboards and views are being produced by summary index's. But even while doing this I have seen a significant performance decrease since implementing this.

Does anyone have any experience with this or best practices to share?

Thanks

Tags (2)

linu1988
Champion

Rather than limiting search term , a role with specific index access will be a good practice.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

I try to not use search term limits because it means that anything that user does at all is prepended with those search terms. This adds complexity and CPU/RAM overhead to every single operation, including saved searches run as that user.

If possible, remove access for that role for regular indexes and only allow it to look at the summary indexes. If that isn't possible or you are still seeing performance issues, you may want to either populate a new index just for this specific role (either from the original data or from the current summary index by using your search term restrictions only and sending everything else via collect to another summary index). Then you can remove the search term restrictions and only provide access for those accounts under that role to that single summary index.

Optionally, spin up a search head on a VM, create the new summary index on it and toss this role on it so it only has access to that subset of data.

Lastly, throw more hardware at the problem by upgrading or replacing the indexer in question.

I've done most of the above solutions in some form or another, including more hardware and search heads (my favorite scalable solution).

--
Jesse Trucks
Minister of Magic
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...