Deployment Architecture

What is the limit of users online in Splunk Enterprise?

Alejandro1195
Engager

Hello , 

I need to find which is the limit of user that can  be online using Splunk Enterprise at the same time ; I have a search head cluster of 4 SH and 1 balancer 

thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

Alejandro1195
Engager

Hi gcusello thanks for your help ! ,  really I need to have  at least 100 users in simultaneus  using  the same Dashboard on Splunk , each user has their own account  and they would be working with the same index

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

as I said, there are many parameters to answer to your question that I listed in my previous post.

in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc...

You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches.

this means that if you optimize your dashboard, you should have 100 searching users in the same time.

My hint is to monitor your installation.

At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods.

If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

Alejandro1195
Engager

Hola gcusello gracias por tu ayuda! , realmente necesito tener al menos 100 usuarios en simultáneo usando el mismo Dashboard en Splunk, cada usuario tiene su propia cuenta y estarían trabajando con el mismo índice

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...