Search parallelization

Once the data is %boarded on Splunk, a search is used to create analytics over the indexed data. Here, the faster the search results produced, the more the real-time results will be. Search parallelization is the easiest and most efficient way to speed up transforming searches by adding additional search pipelines on each indexer. This %helps in processing of multiple buckets at the same time. Search parallelization can also enable acceleration for a transforming search when saved as a report or report-based dashboard panel.

Pipeline parallelization

Underutilized %indexers and resources provide %us with opportunities to execute multiple search pipelines. Since there is no sharing of states, there exists no dependency across ...

Get Splunk: Enterprise Operational Intelligence Delivered now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.