Splunk Enterprise

Federated search performance

smeil123
New Member

동일한 데이터를 로컬 및 원격 검색(연합 검색)을 통해 검색 속도와 비교합니다.

그러나 자동 조회를 사용하는 검색의 경우 검색 속도가 100배 이상 다릅니다.

원격 검색이 훨씬 빠릅니다.(로컬 검색은 10분, 원격 검색은 30초)

왜 이런 속도 차이가 나는지 궁금합니다.

예시)

색인=방화벽 작업=허용

* ACTION은 자동 조회 설정입니다.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...
OSZAR »