Splunk 7.x Quick Start Guide

Job inspector

Every search performed in Splunk results in a search job being created, and each job has a Search ID, which is referenced as a SID. You can inspect the performance of every search using the Job inspector. After running a search, you can click the Job drop-down menu and select Inspect Job to view a new window that displays the search performance metrics associated with every search. There are two major sections to every job inspection: Execution costs and Search job properties.

The Execution costs displays each execution-processing component of a search job, how many invocations of each component were incurred, the input and output event counts, and, most importantly, the Duration in seconds that each component consumed. This ...