Search usage statistics: Instance
This topic is a reference for the Search usage statistics: Instance dashboard in the Distributed Management Console. See About the Distributed Management Console in this manual.
What does this view show?
Several panels about search usage statistics.
Interpret results in this view
The following descriptions apply to the Long-Running Searches table :
- If “Earliest Time” or “Latest Time” is empty, it is probably a real-time search.
- If “Earliest Time” is “-“, it means the earliest time is not specified and will be the start of computer epoch time. For most *nix environments, this is 1 January, 1970.
- If “Latest Time” is “-“, it means the latest time is not specified and will be “now.”
In the Common Search Commands panel, runtimes are in seconds.
What to look out for in this view
It's good practice to look at your long-running searches. You might find a search that you can optimize.
For more information, see "Write better searches" in the Search Manual.
Troubleshoot this view
The historical panels in this view get their data from audit.log. If a panel is blank or missing information from non-indexers, check that you're forwarding your introspection logs to your indexers.
The Long-Running Searches panel also uses information from a REST endpoint.
Search activity dashboards
Indexing performance: Instance
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14