https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318166#M166229 <P>Your search head tier has the capacity to produce 300 concurrent searches (with default settings, i.e. #of cores+6). <BR /> If those are 24 physical cores with hyperthreading enabled, make that 540 concurrent searches (48+6*10).<BR /> So that's your maximum theoretical concurrent search load the search tier can produce.</P> <P>Whether your indexers can handle that depends on how quickly each indexer can complete its part of each search. A lot will depend on your search type, time frames, disk I/O speed, event distribution, etc. <BR /> Any rough estimate would largely be a best guess and of limited use.</P> <P>30 seconds for a "simple search for statistics" seems a lot, btw.</P> Tue, 05 Sep 2017 23:06:56 GMT s2_splunk 2017-09-05T23:06:56Z https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318163#M166226 <P>whats the recommended maximum concurrent searches overall can be performed if we have 40 indexers in a cluster. There are 10 search heads.</P> Tue, 05 Sep 2017 18:32:12 GMT https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318163#M166226 ankithreddy777 2017-09-05T18:32:12Z https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318164#M166227 <P>The answer to that significantly depends on your average search execution time (which depends on search complexity and event distribution) and the number of cores you have in both, search heads and indexers.<BR /><BR /> In other words, we can't really answer this question without knowing these things.</P> Tue, 05 Sep 2017 19:40:01 GMT https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318164#M166227 s2_splunk 2017-09-05T19:40:01Z https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318165#M166228 <P>May I get an rough estimation. <BR /> Average search time 30 secs with simple searches for statistics.<BR /> number of cpus=24 on search heads and indexers<BR /> indexers =40 in a cluster<BR /> search heads = 10</P> <P>What can be the rough estimate of Max concurrent searches can be performed indexers using SH. </P> Tue, 05 Sep 2017 22:03:58 GMT https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318165#M166228 ankithreddy777 2017-09-05T22:03:58Z https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318166#M166229 <P>Your search head tier has the capacity to produce 300 concurrent searches (with default settings, i.e. #of cores+6). <BR /> If those are 24 physical cores with hyperthreading enabled, make that 540 concurrent searches (48+6*10).<BR /> So that's your maximum theoretical concurrent search load the search tier can produce.</P> <P>Whether your indexers can handle that depends on how quickly each indexer can complete its part of each search. A lot will depend on your search type, time frames, disk I/O speed, event distribution, etc. <BR /> Any rough estimate would largely be a best guess and of limited use.</P> <P>30 seconds for a "simple search for statistics" seems a lot, btw.</P> Tue, 05 Sep 2017 23:06:56 GMT https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318166#M166229 s2_splunk 2017-09-05T23:06:56Z https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318167#M166230 <P>did you get an answer to your question ? </P> Tue, 16 Jan 2018 09:08:16 GMT https://community.splunk.com/t5/Splunk-Search/Recommended-maximum-concurrent-searches/m-p/318167#M166230 DavidHourani 2018-01-16T09:08:16Z