Splunk Search

Which commands scale/distribute well

chris
Motivator

If I have a Splunk environment/installation that consists of at least one search head and multiple indexer installations is there an easy way to determine which commands perform well (and which commands do not)?

From the following technical paper I found out, that there is a map and a reduce part for every search:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf

I am assuming that streaming commands are the ones that can be run in parallel during the map part of the search:
http://docs.splunk.com/Splexicon:Streamingcommand

I am also assuming that in the Job inspector the "remoteSearch" part is the part of the search that can be run in parallel which is efficient:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

From experience I know, that the "stats" command can be a much better option (from performance perspective) than "transaction".

Is there any documentation with information about performance/internals about how the commands distribute?

Thanks
Chris

1 Solution

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

View solution in original post

Jason
Motivator

Any update on this? I thought I heard of some document improving on http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutthesearchlanguage#Types_of_search_com... recently.

0 Karma

sophy
Splunk Employee
Splunk Employee

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...