Search performance

Splunk is optimized for text-based searching of raw event data. By default, Splunk indexes some components of each event (default fields: host, source, sourcetype). Splunk can be configured to extract and index additional components as you see fit. Performance may be affected if Splunk is:

indexing or extracting additional fields
accessing compressed raw data
accessing a large number of events (you can change this by altering your time range, or maximum results you search for)

You can improve Splunk's search performance by changing indexing properties such as time stamping and segmentation. Here are some general guidelines to help you tune your search performance:

Set the size of your hot db to the maximum that your system can handle. This is dependent on the amount of RAM your system contains.
Reduce or eliminate segmentation by removing MINOR breakers, or turning some MINOR breakers into MAJOR breakers. Play with the breakers to optimize your searches based on the contents of the events particular to your scenario.
Separate data into different indexes. This is an advanced technique that is only applicable if you are adding archived data while your Splunk server is indexing current data.
Make sure that time stamping is correct on events.

Below are some of the parameters in various configuration files that may improve your search performance.

indexes.conf

indexes.conf controls how Splunk accesses system memory.

{{maxDataSize = <non-negative number>}

The maximum size in MBs of the hot DB. The hot DB will grow to this size before it is rolled out to warm. Do not increase the default setting unless Splunk is running in 64bit mode. Defaults to 750. With a 64-bit system, set this no larger than the amount of RAM in the system.

maxQueryIds = <non-negative number> The maximum number of IDs a search will attempt to resolve in a single query. Defaults to 10000000. This is a good value for 32 bit systems. You can raise this setting for 64bit installations with lots of RAM.

props.conf

props.conf controls indexing properties based on settings tied to each event's source, host, or source type.

`DATETIME_CONFIG = <filename relative to Splunk_HOME>`	Specifies the file to configure the timestamp extractor. This configuration may also be set to "NONE" to prevent the timestamp extractor from running or "CURRENT" to assign the current system time to each event. Defaults to /etc/datetime.xml (eg $SPLUNK_HOME/etc/datetime.xml).
`TIME_FORMAT = <strptime-style format> (empty)`	Specifies a strptime format to extract the date. Specifying a strptime format for date extraction accelerates event indexing.

web.conf

Many of Splunk Web's setting are available in web.conf. Here are a few attributes you can set to help searches run faster:

`numberOfEventsPerCard = <integer>`	Configuration for the number of events that the Endless Scroller asks the server for with each request. Defaults to 10.
`numberOfCardsPerDeck = <integer>`	Configuration for the number of requests that the Endless Scroller will make before it starts to recycle space occupied by prior pages. Defaults to 7.

fields.conf

If you have configured indexed fields, configure fields.conf to specify that fields are indexed. This speeds up search results.

Configure Splunk Web

Change settings for Splunk Web to make search faster.

Disable typeahead

Typeahead is not restricted to your current time range. If you have large datasets of days, months or years, typeahead can be very slow and load the server.

You can disable typeahead altogether. To affect this change, edit SPLUNK_HOME/share/splunk/search_oxiclean/static/js/typeahead.js

Look for the string TypeAheadQuery.prototype.send. It is the first line of a function that's about 30 lines.

In the middle of this function, you will find the following code:

   if (selectionRange.startTime) { 
       qArgs['startTime'] = selectionRange.startTime.print(window.SEARCH_TERM_TIME_FORMAT); 
   } 
   if (selectionRange.endTime) { 
       qArgs['endTime'] = selectionRange.endTime.print(window.SEARCH_TERM_TIME_FORMAT); 
   }

Insert this new line right after the above block of code:

if (!selectionRange.startTime || !selectionRange.endTime) return false;

This disables typeahead entirely unless you've clicked a bar in the timeline, or are using custom time.

Set segmentation in Splunk Web

Under the Preferences tab in Splunk Web, change segmentation settings. Raw is the fastest, but disables clicking on any events. Play around with the different segmentation settings to find which one is the best for your dataset.

Previous: Indexing performance | Next: Cache report results

Comments

No comments have been submitted.