Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
I'm with Jamal on this one. Decreasing the concurrent scheduled searches sounds like a recipe for disaster. You want your searches to run smoothly, not get stuck in a traffic jam.
Ha! Decreasing the maximum size of the search pipelines? That's like trying to fit more people in a crowded elevator. It's just going to make things worse.
User 2: User Comment: Ha! Decreasing the maximum size of the search pipelines? That's like trying to fit more people in a crowded elevator. It's just going to make things worse.
I'm not sure about that. Increasing the maximum number of hot buckets might be a better solution. That way, the index can handle more data without getting bogged down.
Ezekiel
26 days agoStefany
28 days agoJamal
1 months agoChun
14 days agoMagnolia
16 days agoAlfred
1 months agoCarylon
4 days agoOwen
19 days agoTimothy
2 months agoKristin
17 days agoLovetta
22 days agoLenny
2 months agoLore
2 months agoLashonda
2 months ago