Splunk® Enterprise

Monitoring Splunk Enterprise

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Search usage statistics: Instance

This topic is a reference for the Search usage statistics: Instance dashboard in the Distributed Management Console. See About the Distributed Management Console in this manual.

What does this view show?

Several panels about search usage statistics.

Interpret results in this view

The following descriptions apply to the Long-Running Searches table :

  • If “Earliest Time” or “Latest Time” is empty, it is probably a real-time search.
  • If “Earliest Time” is “-“, it means the earliest time is not specified and will be the start of computer epoch time. For most *nix environments, this is 1 January, 1970.
  • If “Latest Time” is “-“, it means the latest time is not specified and will be “now.”

In the Common Search Commands panel, runtimes are in seconds.

What to look out for in this view

It's good practice to look at your long-running searches. You might find a search that you can optimize.

For more information, see "Write better searches" in the Search Manual.

Troubleshoot this view

The historical panels in this view get their data from audit.log. If a panel is blank or missing information from non-indexers, check that you're forwarding your introspection logs to your indexers.

The Long-Running Searches panel also uses information from a REST endpoint.

Last modified on 18 March, 2016
Search activity dashboards
Indexing performance: Instance

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters