Concurrent Historical Searches still set to old value

[saad_siddiqi]

Hi There,

I have recently upgraded the Number of CPUs at the Search head from 2 to 4 but the Search limit is still set to the old value.

Is there anything which needs to be done after doing a hardware upgrade in order to make splunk recognize it?

Thanks

[linu1988 · Accepted solution]

Hello Siddigi,
If you are referencing to the stanza

max_searches_per_cpu =
* The maximum number of concurrent historical searches per CPU. The system-wide limit of
historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1

then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables.

It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist.

Please have a look at the documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf.

[saad_siddiqi]

Yeah i am referring to limits.conf and I thought the same but splunk still displayed the older limit even after increase of CPUs. Don't know why is that. Is there any time after which splunk recognizes new resources??

[linu1988]

Are you referencing to limits.conf? I think splunk will automatically calculate the number of processors available and make your searches concurrent according to that.