Deployment Architecture

Concurrent Historical Searches still set to old value

saad_siddiqi
Path Finder

Hi There,

I have recently upgraded the Number of CPUs at the Search head from 2 to 4 but the Search limit is still set to the old value.

Is there anything which needs to be done after doing a hardware upgrade in order to make splunk recognize it?

Thanks

Tags (2)
0 Karma
1 Solution

linu1988
Champion

Hello Siddigi,
If you are referencing to the stanza

max_searches_per_cpu =
* The maximum number of concurrent historical searches per CPU. The system-wide limit of
historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1

then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables.

It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist.

Please have a look at the documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf.

View solution in original post

linu1988
Champion

Hello Siddigi,
If you are referencing to the stanza

max_searches_per_cpu =
* The maximum number of concurrent historical searches per CPU. The system-wide limit of
historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1

then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables.

It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist.

Please have a look at the documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf.

saad_siddiqi
Path Finder

Yeah i am referring to limits.conf and I thought the same but splunk still displayed the older limit even after increase of CPUs. Don't know why is that. Is there any time after which splunk recognizes new resources??

0 Karma

linu1988
Champion

Are you referencing to limits.conf? I think splunk will automatically calculate the number of processors available and make your searches concurrent according to that.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...