Deployment Architecture

What is the limit of users online in Splunk Enterprise?

Alejandro1195
Engager

Hello , 

I need to find which is the limit of user that can  be online using Splunk Enterprise at the same time ; I have a search head cluster of 4 SH and 1 balancer 

thanks 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

if you're speaking of a license limit, there are no limitys to concurrent users.

If you're speaking of resource occupation there are other parameters to consider:

  • scheduled searches,
  • how many searches are done by the users,
  • hardware configurations;
  • volume of data,
  • presence of Apps as Enterprise Security or ITSI,
  • storage performaces (this usually is the bottleneck of every Splunk architecture!).

In other words it's very difficoult to define a limit for the concurrent users.

My hint is to monitor your infrastructure, using the Monitoring Console, analyzing the hardware occupation and eventual delays in searches.

In general using 4 Search Heads, with at least the reference hardware, you can have tens of concurrent users.

Ciao.

Giuseppe

0 Karma

Alejandro1195
Engager

Hi gcusello thanks for your help ! ,  really I need to have  at least 100 users in simultaneus  using  the same Dashboard on Splunk , each user has their own account  and they would be working with the same index

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Alejandro1195,

as I said, there are many parameters to answer to your question that I listed in my previous post.

in addition you have to consider the searches inside your dashbord: are they optimized, do they contain real time searches, etc...

You have to consider that each search in Splunk takes a CPU, so if you have 4 SHs with 12 CPUs you can run 48 simoultaneous searches.

this means that if you optimize your dashboard, you should have 100 searching users in the same time.

My hint is to monitor your installation.

At the same time, you could optimize you dashboard avoiding slow searches (e.g. containing transaction or join commands), avoiding real time searches and eventually use acceleration methods.

If al the users use the same dashboard, you could also use reports to accelerate your dashboards (https://docs.splunk.com/Documentation/SplunkCloud/9.0.2208/Knowledge/Aboutsummaryindexing) or using Data Models or Summary indexes.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

Alejandro1195
Engager

Hola gcusello gracias por tu ayuda! , realmente necesito tener al menos 100 usuarios en simultáneo usando el mismo Dashboard en Splunk, cada usuario tiene su propia cuenta y estarían trabajando con el mismo índice

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...