Archive

What is the significance of the base_max_search constant?

Path Finder

Hi Splunkers,

I am aware of the calculation used to arrive at the max concurrent searches that can be executed on a search head.
No. of concurrent searches = max_searches_per_cpu x number_of_cpu's + base_max_searches

Here by default max_searches_per_cpu=1 and base_max_seaches=6

Now, let's consider a 2 CPU SH with 4 cores.
No. of concurrent searches = (1 x (2x4)) + 6 = 14
What I don't understand here is, how can I execute 14 concurrent searches when I only have the capability for 2x4=8 searches? What is the significance of base_max_search constant?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

View solution in original post

Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

View solution in original post

Path Finder

Holger,
I got your point. Thank you for shedding some light around the mystery.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!