topic Re: What is the significance of the base_max_search constant? in Splunk Search

What is the significance of the base_max_search constant?

ppuru — Tue, 29 Sep 2020 16:58:45 GMT

Hi Splunkers,

I am aware of the calculation used to arrive at the max concurrent searches that can be executed on a search head.
No. of concurrent searches = max_searches_per_cpu x number_of_cpu's + base_max_searches

Here by default max_searches_per_cpu=1 and base_max_seaches=6

Now, let's consider a 2 CPU SH with 4 cores.
No. of concurrent searches = (1 x (2x4)) + 6 = 14
What I don't understand here is, how can I execute 14 concurrent searches when I only have the capability for 2x4=8 searches? What is the significance of base_max_search constant?

Re: What is the significance of the base_max_search constant?

hsesterhenn_spl — Tue, 29 Sep 2020 18:42:30 GMT

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

Re: What is the significance of the base_max_search constant?

ppuru — Wed, 28 Mar 2018 14:57:51 GMT

Holger,
I got your point. Thank you for shedding some light around the mystery.