Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
I'm with Jamal on this one. Decreasing the concurrent scheduled searches sounds like a recipe for disaster. You want your searches to run smoothly, not get stuck in a traffic jam.
Ha! Decreasing the maximum size of the search pipelines? That's like trying to fit more people in a crowded elevator. It's just going to make things worse.
User 2: User Comment: Ha! Decreasing the maximum size of the search pipelines? That's like trying to fit more people in a crowded elevator. It's just going to make things worse.
I'm not sure about that. Increasing the maximum number of hot buckets might be a better solution. That way, the index can handle more data without getting bogged down.
Ezekiel
1 months agoStefany
1 months agoJamal
2 months agoCordelia
5 days agoChun
29 days agoMagnolia
1 months agoAlfred
2 months agoStaci
12 days agoCarylon
19 days agoOwen
1 months agoTimothy
2 months agoKristin
1 months agoLovetta
1 months agoLenny
2 months agoLore
2 months agoLashonda
3 months ago