The third workshop in our workshop series for the Splunk Admin / Owner / Program Manager is a workshop on optimizing the search experience.
One of the questions I often hear is, ‘Where’s the turbo button?’ We’re working on that, but it’s not easy to make a turbo button that will work for everyone so we want to empower you to make better decisions about how you search. This is a workshop designed to help Splunk users supercharge their searches, slim down searches by addressing common mistakes and help users understand how the search engine works under the hood. In many ways, performance is governed by the hardware and Splunk infrastructure already in place, however there are some critical decisions users can make to increase search speeds. Get smarter. Go faster.
The workshop first describes how users often defeat themselves without even knowing it. Then it will build knowledge of the search engine from the ground up by peaking into the Splunk datastore structure. Splunk is not a relational, columnar database. The workshop will then help users apply this understanding to the performance profiles of different types of search and discuss general strategies for each. It also covers ways to customize SplunkWeb for faster searching. Of course, it also provides avenues for getting help or going even deeper.
Hardware/infrastructure factors are not within the scope of this workshop. The focus of the session is the knobs and levers under the influence of the Splunk end user.
One of the more surprising nuggets I discovered while creating this workshop is just how much some of these decisions impact search speeds. For example, in my own experimentation, turning off Field Discovery can reduce execution time by a factor of 3. Discover more tips like these.
In case you’re curious, these photos are from our very own speed racer Jason Stein, Regional Account Manager for the Southwest. Zooms!
Other workshops in this series: