O'Reilly logo

Splunk 7 Essentials - Third Edition by Betsy Page Sigman, Erickson Delgado, J-P Contreras

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Search capacity

When Splunk executes a search, all runtime search processing happens in the Splunk searching layer component known as a search head. When a Splunk search runs, it executes on a single CPU processor core by the search head, which then works with the various indexing resources to capture, summarize, and present the results. Therefore, the number of cores must be able to handle the amount of concurrent searching you users will require, which includes scheduled searches, ad hoc use, alerts, and so on. It is important to monitor these channels of search activity as usage of the Splunk environment increases. Consuming all search resources will deteriorate the user's experience. Monitoring growing demand and staying ahead of full ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required