Variables that impact product performance

Product performance is impacted by various factors, depending on your deployment size and scale. You can use the following information as a high-level guide for understanding the factors that can impact your deployment sizing and the approximate impact they are likely to have on product performance.

The following table lists the variables that can impact the product performance along with the levels of impact to each of the system resources.

Variables that impact product performance

VariableImpact on resources 
Number of data collectorsMediumLowMediumMedium 
Retention periodNoneMediumHighLow 
Number of tags defined for the data collectorsMediumLowMediumLow 
Number of fields added to the Fields section available under the Filters panel on the Search tab.HighNoneNoneLow 
Number of fields specified in data patternsLowNoneMediumNone 
Number of unique field values in the Fields section available under the Filters panel on the Search tab.LowHighHighHigh 
Volume of data indexed per dayHighLowHighHigh 
Number of managed hostsMediumLowLowLowThe Anomaly baseline job that is enabled is a function of the number of hosts.
Simple search commands
(Search commands with nontabular output)
Advanced search commands
(timechart, stats, top, rare, and group)

Requires high CPU utilization by the Indexer and Search components.

Avoid using high cardinality fields (fields with large number of unique values) in the by parameters. This is applicable while running those search commands where the by parameter is supported.

Number of concurrent usersHighHighNoneHigh

If a large number of users are executing concurrent searches or loading dashboards, or if there are too many notifications set up for execution, you might find that your system has become too slow.

If you execute a search string processing a large amount of search results and while it still processing the results, if you found what you were looking for, you can pause or stop the search from executing further results. For more information about pausing or stopping a search, see Getting started with search.

Number of notification alertsLowLowNoneLowNotification alerts are meant for shorter time period searches.
Number of notification reportsLowLowNoneLowNotification reports are expected to range for medium time period searches.
Number of dashboards and dashletsMediumMediumNoneMediumPerformance overhead of a dashlet is the same as that of a manual run of the saved search used for creating the dashlet.
Anomaly DetectionHighLowMediumMediumImpacts both Search and Indexer components
Indexer redundancyMediumLowHighMedium 

1 Processor utilization (CPU)

2 Memory utilization (RAM)

3 Storage utilization (disk space)

4 I/O transfer rate (disk read/write rate)

Was this page helpful? Yes No Submitting... Thank you