Searches to check search concurrency for historical or real time

The following Splunk search will output historical or real time concurrency in a timechart by host.
*NOTE* Change the text <search_head> to your search heads name, alternatively use a *.
index=_internal host= source=*metrics.log group=search_concurrency "system total" NOT user=* | timechart max(active_hist_searches) by host
index=_internal host= source=*metrics.log group=search_concurrency "system total" NOT user=* | timechart max(active_realtime_searches) by host
Share This:

Leave A Comment?