Deployment Architecture

What is the limit of users online in Splunk Enterprise?

Alejandro1195
Engager

Hello , 

I need to find which is the limit of user that can  be online using Splunk Enterprise at the same time ; I have a search head cluster of 4 SH and 1 balancer 

thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

0 Karma

Alejandro1195
Engager

Hi gcusello thanks for your help ! ,  really I need to have  at least 100 users in simultaneus  using  the same Dashboard on Splunk , each user has their own account  and they would be working with the same index

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

as I said, there are many parameters to answer to your question that I listed in my previous post.

in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc...

You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches.

this means that if you optimize your dashboard, you should have 100 searching users in the same time.

My hint is to monitor your installation.

At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods.

If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

Alejandro1195
Engager

Hola gcusello gracias por tu ayuda! , realmente necesito tener al menos 100 usuarios en simultáneo usando el mismo Dashboard en Splunk, cada usuario tiene su propia cuenta y estarían trabajando con el mismo índice

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...