Building for the Splunk Platform

Determine values for max concurrent historical searches

Path Finder

Im trying to come up with the values for the amount of max concurrent historical searches because we get the error:

the maximum number of concurrent
historical searches on this instance
has been reached

I know in the limits.conf we can set the values that are used to set the limit:

from splunk docs

max_searches_per_cpu = < int>

The maximum number of concurrent historical searches for each CPU.
The system-wide limit of historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
When I check resourse management I dont even see 1 machine with 1% load all are around 0.5%

We have 3 searchheads 2 indexes 1 mgmt.
How should i determine the values for "max_searches_per_cpu " and "base_max_searches" as It seems unnecessary to me that we get errors when our load is so low.

0 Karma


There is a really good write-up here:

It discusses the pros and cons of quota enforcement by cluster-wide or by member-by-member

Remember that the majority of time spent searching actually happens on the indexers. However the limits are controlled by the specs of the SH boxes. Keep this in mind when adjusting these settings.


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...