https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196214#M2037 <P>Okay , After I upgrade Splunk to its latest version .. Suggest me what action i can handle ?</P> Tue, 07 Jan 2014 00:50:46 GMT chimbudp 2014-01-07T00:50:46Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196212#M2035 <P>Background :<BR /><BR /> I am using Splunk verion 4.3.3 , having 4 indexer with 1 Search head and using the default configurations for limits.conf. <BR /></P> <P>OS : RHEL 6<BR /><BR /> Subnet : logging<BR /><BR /> HDD 1 : 40<BR /><BR /> HDD 2: 100<BR /><BR /> Memory : 16<BR /><BR /> CPU cores :4<BR /> </P> <P>By default settings my search head is capable of doing 4 concurrent searches. (as recommended by splunk)<BR /> However often i am getting maximum historical search limit is reached. and this is quite annoying for my users.</P> <P>Suggest me a best idea to resolve this, (something from my readings , correct me if i am wrong below)</P> <UL> <LI>Shall i tweak the default settings in limits.conf . How far this is recommended to localize this configuration file ?</LI> <LI>Shall i increase the no. of cores in Search head's CPU ? </LI> <LI>Do i need to go for multiple search heads ?</LI> </UL> <HR /> <P>Can i try this ,<BR /><BR /><BR /> restrict the Splunk users triggering a complex query | or a query which fetches very old data .<BR /> Restrict features in TimeRange picker -remove "All Time" selection</P> <P>However i wanted to limit the users from complex query. Is there any tricks ?<BR /> or any way to force the search query to show limited data , even though long time range is selected ? </P> <P>Kindly advice.</P> <P>Thanks,<BR /><BR /> Chimbu</P> Mon, 06 Jan 2014 10:30:33 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196212#M2035 chimbudp 2014-01-06T10:30:33Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196213#M2036 <P>Version 4.3.3 is no longer supported. I suggest upgrading both Splunk and the number of cores you have. The hardware specification requirements are here: <CODE><A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/SystemRequirements#Recommended_hardware" target="test_blank">http://docs.splunk.com/Documentation/Splunk/6.0.1/Installation/SystemRequirements#Recommended_hardware</A></CODE></P> Mon, 06 Jan 2014 13:28:15 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196213#M2036 alacercogitatus 2014-01-06T13:28:15Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196214#M2037 <P>Okay , After I upgrade Splunk to its latest version .. Suggest me what action i can handle ?</P> Tue, 07 Jan 2014 00:50:46 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196214#M2037 chimbudp 2014-01-07T00:50:46Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196215#M2038 <P>The message shows up because of the limitation on the roles for concurrent searches. You can have savedsearch to avoid this, or the maximum concurrent searches needs to be altered</P> Tue, 07 Jan 2014 05:15:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196215#M2038 linu1988 2014-01-07T05:15:59Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196216#M2039 <P>I cant have savedseraches , since the searches are fired from some external componenets via REST API ...</P> Tue, 07 Jan 2014 05:31:44 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196216#M2039 chimbudp 2014-01-07T05:31:44Z https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196217#M2040 <P>Then it needs to be set particular to the role in authorize.conf ,parameters like srchMaxTime,srchTimeWin,srchJobsQuota will help you restrict the users to have long queries. Regarding the complexity there are not many option if you don't have any static queries to allow them to.</P> Tue, 07 Jan 2014 06:51:04 GMT https://community.splunk.com/t5/Monitoring-Splunk/Restrict-users-to-fire-complex-query-force-kill-the-complex/m-p/196217#M2040 linu1988 2014-01-07T06:51:04Z