Splunk Search

Is it possible to search Splunk for list of concurrent searches usage over time?

Motoko89
Path Finder

Hello, is it possible to search Splunk for list of concurrent searches usage over time by searching internal log?

Similar to this question for daily license usage:
https://answers.splunk.com/answers/68036/daily-license-usage-query.html

0 Karma

niketn
Legend

Refer to @somesoni2's answer for the same: https://answers.splunk.com/answers/381951/monitor-concurrent-searches.html

 index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adonio
Ultra Champion

or use the DMC (after 6.5.0 its called MC)

0 Karma

Richfez
SplunkTrust
SplunkTrust

Converted to answer, because I think it's an answer. 🙂

Also, perhaps to add to that just a tiny bit:

index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency earliest=-1w
| timechart max(active_hist_searches), max(active_realtime_searches)

Which will show the last week's worth. Do line chart.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...