Deployment Architecture

What is the limit of users online in Splunk Enterprise?

Alejandro1195
Engager

Hello , 

I need to find which is the limit of user that can  be online using Splunk Enterprise at the same time ; I have a search head cluster of 4 SH and 1 balancer 

thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

0 Karma

Alejandro1195
Engager

Hi gcusello thanks for your help ! ,  really I need to have  at least 100 users in simultaneus  using  the same Dashboard on Splunk , each user has their own account  and they would be working with the same index

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

as I said, there are many parameters to answer to your question that I listed in my previous post.

in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc...

You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches.

this means that if you optimize your dashboard, you should have 100 searching users in the same time.

My hint is to monitor your installation.

At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods.

If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

Alejandro1195
Engager

Hola gcusello gracias por tu ayuda! , realmente necesito tener al menos 100 usuarios en simultáneo usando el mismo Dashboard en Splunk, cada usuario tiene su propia cuenta y estarían trabajando con el mismo índice

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...