Configure background search operations for the Catalog
Configure background Catalog search operations in Splunk Cloud Platform to prevent Catalog information from becoming stale or incomplete.
The Catalog is a page that displays information about the Splunk indexes and federated datasets that are available to a given user, based on the roles granted to the user and the permissions configured in the datasets. To retrieve information and populate the Catalog, Splunk Cloud Platform periodically runs search operations in the background.
If necessary, you can turn these background search operations on or off by submitting a request to Splunk customer support.
Before requesting any configuration changes, review this page to learn more about the purpose and impact of each search operation.
Search operations
The following table summarizes the background search operations that support the Catalog:
| Operation name | Purpose | Usage and impact | Search frequency | Counts towards the concurrent search limit? |
|---|---|---|---|---|
| Splunk Index Discovery |
Retrieves Splunk indexes and includes information such as name, type, and dataset statistics |
Splunk Index Discovery is turned on by default. This operation is required for the Catalog's core feature of discovering and listing Splunk indexes. It does not use SPL or SPL2 searches to retrieve index information, and so it has negligible impact on system performance and SVC consumption. As a best practice for ensuring that the Catalog works correctly, leave the Splunk Index Discovery operation on. |
Every 30 minutes | No |
| Schema Collection |
Retrieves the list of index-time extracted fields for Splunk indexes |
Schema Collection is turned off by default. This optional operation allows the Catalog to display the Fields section in the side panel that opens when you select a Splunk index. The Fields section shows the names of the event fields in the selected index. To allow users to inspect the schema of their Splunk indexes before they run any SPL or SPL2 searches, turn on Schema Collection. However, be aware that this operation can have low to medium impact on search concurrency and SVC consumption, depending on the amount of data indexed in the Splunk platform deployment. |
|
Yes |