https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177270#M50956 <P>The following is the current configuration in our environment. We are getting <CODE>max_concurrent limit reached</CODE> on one of the three Search Heads for specific Saved Search. It does not happen on rest of the two Search Heads.<BR /> <CODE>Search Head:- 3x16+10=58</CODE><BR /> <CODE>Search Peer :- 1x20+6=26</CODE></P> <P>Is it necessary to maintain identical parameters on both Search peers and Search heads?<BR /> Shall i increase <CODE>max_searches_per_cpu</CODE> on <CODE>Search Peers</CODE> from <CODE>1</CODE> to <CODE>2</CODE>?</P> Wed, 01 Mar 2017 07:45:47 GMT biec1 2017-03-01T07:45:47Z https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177268#M50954 <P>What is the max value for maxsearches? Is there a way to NOT have a max (set to 0 or -1)?</P> Tue, 18 Aug 2015 17:58:09 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177268#M50954 dougmartin 2015-08-18T17:58:09Z https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177269#M50955 <P>You can adjust this, but the primary calculation is a practical limit on performance. This is controlled in <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Admin/Limitsconf">limits.conf</A>.</P> <P>The maximum number of concurrent searches is calculated based on <CODE>max_searches_per_cpu</CODE> times the number of CPU cores in the system (as reported by the OS, which means VMs often lie when given multiple vCPUs but are running on a small number of hardware cores thanks to threading and shady hypervisor oversubscription models) + <CODE>base_max_searches</CODE>.</P> <P><CODE>max_searches_per_cpu</CODE> defaults to 1<BR /> <CODE>base_max_searches</CODE> defaults to 6</P> <P>Therefore, in a reference system with 12 cores, you have <CODE>1 x 12 + 6 = 18</CODE>.</P> <P>If you need to crank this up, you can linearly scale this by core count using <CODE>max_searches_per_cpu</CODE> by setting it to 2 or more. This changes the math to be <CODE>2 x 12 + 6 = 30</CODE> or <CODE>3 x 12 + 6 = 42</CODE>. If you just want to tweak it up by a fixed amount, adjust <CODE>base_max_searches</CODE> to a higher value.</P> <P>All of the above comes with the caveat that generally these are bad ideas to implement in a production setting unless you have a highly underutilized system performing large numbers of extremely low memory and low CPU usage searches.</P> Tue, 18 Aug 2015 19:09:52 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177269#M50955 jtrucks 2015-08-18T19:09:52Z https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177270#M50956 <P>The following is the current configuration in our environment. We are getting <CODE>max_concurrent limit reached</CODE> on one of the three Search Heads for specific Saved Search. It does not happen on rest of the two Search Heads.<BR /> <CODE>Search Head:- 3x16+10=58</CODE><BR /> <CODE>Search Peer :- 1x20+6=26</CODE></P> <P>Is it necessary to maintain identical parameters on both Search peers and Search heads?<BR /> Shall i increase <CODE>max_searches_per_cpu</CODE> on <CODE>Search Peers</CODE> from <CODE>1</CODE> to <CODE>2</CODE>?</P> Wed, 01 Mar 2017 07:45:47 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-max-value-for-maxsearches-Is-there-a-way-to-NOT-have/m-p/177270#M50956 biec1 2017-03-01T07:45:47Z