Hi There,
I have recently upgraded the Number of CPUs at the Search head from 2 to 4 but the Search limit is still set to the old value.
Is there anything which needs to be done after doing a hardware upgrade in order to make splunk recognize it?
Thanks
Hello Siddigi,
If you are referencing to the stanza
max_searches_per_cpu =
* The maximum number of concurrent historical searches per CPU. The system-wide limit of
historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1
then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables.
It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist.
Please have a look at the documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf.
Hello Siddigi,
If you are referencing to the stanza
max_searches_per_cpu =
* The maximum number of concurrent historical searches per CPU. The system-wide limit of
historical searches is computed as:
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
* Note: the maximum number of real-time searches is computed as:
max_rt_searches = max_rt_search_multiplier x max_hist_searches
* Defaults to 1
then splunk would automatically know that your system has "N" number of CPU. As you mentioned that two more CPU's are added then now there would be "1*4+6". The number of CPU can be taken from OS/ENV variables.
It's like variables. But no where the number of CPU will written like a constant, in that case if you have 4 CPU and you mention in config it's 16 would it be correct? I guess you can get the gist.
Please have a look at the documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf.
Yeah i am referring to limits.conf and I thought the same but splunk still displayed the older limit even after increase of CPUs. Don't know why is that. Is there any time after which splunk recognizes new resources??
Are you referencing to limits.conf? I think splunk will automatically calculate the number of processors available and make your searches concurrent according to that.