Healthy search loads are critical to the performance of your entire Splunk Cloud Platform environment. Understanding search patterns can help you understand if your search workload is aligned with best practices and optimized for the best performance. The dashboards accessed from the Cloud Monitoring Console > Search tab help you determine if a specific user, search, dashboard, or app is inhibiting your performance. If you encounter an issue, you can then work with users to improve performance.

When searches run for a long time, they may use too much computation and memory, causing an overall slowness of the Splunk instance. This commonly occurs when a few poorly formed searches are taking a large amount of resources. It can also occur if you have a dashboard that is being frequently used by multiple users concurrently. In each of these cases, investigating further can help you to pinpoint the searches that are long-running and determine if you can optimize them.

Because each company's environment is different, it's not easy to set benchmarks for search performance. Generally, the best way to understand your search performance is to compare your historical search times with your current search times to see if there is a change. If search runtimes have slowed, review changes to your environment and new searches to determine if you need to optimize your searches or environment. For example, you may have added a poorly formed search, or you may have added a dashboard that has attracted a lot of traffic.

For more information about optimizing searches, see About search optimization in the Splunk Cloud Platform Search Manual.