What is the limit of users online in Splunk Enterprise?

[Alejandro1195]

Hello , 

I need to find which is the limit of user that can  be online using Splunk Enterprise at the same time ; I have a search head cluster of 4 SH and 1 balancer 

thanks 

[gcusello · Accepted solution]

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

• scheduled searches,
• how many searches are done by the users,
• hardware configurations;
• volume of data,
• presence of Apps as Enterprise Security or ITSI,
• storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

[Alejandro1195]

Hi gcusello thanks for your help ! ,  really I need to have  at least 100 users in simultaneus  using  the same Dashboard on Splunk , each user has their own account  and they would be working with the same index

[gcusello]

Hi @Alejandro1195,

as I said, there are many parameters to answer to your question that I listed in my previous post.

in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc...

You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches.

this means that if you optimize your dashboard, you should have 100 searching users in the same time.

My hint is to monitor your installation.

At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods.

If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

[Alejandro1195]

Hola gcusello gracias por tu ayuda! , realmente necesito tener al menos 100 usuarios en simultáneo usando el mismo Dashboard en Splunk, cada usuario tiene su propia cuenta y estarían trabajando con el mismo índice