Deployment Architecture

Are there performance issues for increasing the "max_searches_per_CPU" setting in limits.conf to accommodate more historical concurrent searches?

ankithreddy777
Contributor

I have 16 core CPU on search head which accommodate 22 concurrent searches by default. When 22 concurrent searches is reached, it shows limit has been reached, but the CPU utilization is only 20 percent.

Can we increase the max_searches_per_CPU=2 or 3 in order to accommodate more historical concurrent searches. Does this have any performance issues?

Why does Splunk have default value=1?

0 Karma

eagle4splunk
Explorer

If your system can handle the load, you can increase your max_searches_per_cpu. I had an old instance where we had it at 6 on search heads with 12 core CPUs.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...