Deployment Architecture

Search Head Cluster concurrency context configuration (instance-wide) vs logs (cluster-wide)

Path Finder

Hello there,

We have a Search Head Cluster in 6.5.3 which configured by default in "member by member".

Our configuration :


Splunk Documentation :

To enforce quotas on a member-by-member basis, use this configuration:


Version Default enforcement
6.3-6.4 cluster-wide
6.5+ member-by-member

However, while investigating skip ratio, it appears that logs are saying the opposite :

index=_internal sourcetype=scheduler status=skipped | stats count by concurrency_context

cluster-wide 1636
saved-search_cluster-wide 144

Does anyone knows if this is a logging issue or else ?

Thanks for any hint!

0 Karma

Path Finder

I have noticed the same behavior after updating to 6.6.3. last night. Even though instance level quotas should be enforced by default, the logs look as though a cluster level quota is being enforced instead.

I am currently looking through my configs. I will let you know if I make progress on my end.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!