Federated search performance

These performance considerations and optimization tips apply to a federated search deployment.

Search performance

• Federated searches are typically slower than local searches.
• Network latency affects performance.
• Use stats and other aggregations on the remote side when possible.

Optimization tips

1. Apply index and time filters early to reduce data transfer:

   CODECopy

   index=federated:r_audit earliest=-1h | stats count by sourcetype

   index=federated:r_audit earliest=-1h | stats count by sourcetype

2. Use streaming commands that run on the remote side:

   CODECopy

   index=federated:r_audit | stats count by host | sort -count

   index=federated:r_audit | stats count by host | sort -count

3. Avoid commands that don't work well with federated search:

   • transaction runs locally.
   • join can be expensive.
   • append with multiple federated sources.

Connection pooling

Splunk maintains connection pools to remote providers. The default pool size is 5 connections per provider. Configure the pool size in limits.conf if needed:

[federated_search]
max_concurrent_searches_per_provider = 5