What is the optimum value for maxThreads and maxSockets when configuring server.conf?

[keerthana_k]

Hi,

We have a Splunk distributed deployment with indexer clustering. We are currently exposing a Splunk app in the search head through REST and using it to fetch results and display in another application. We are currently running about 50 searches every 5 minutes.

However, we find that after a while the Splunk daemon stops responding to requests even though it shows running status. On debugging this issue and going through Splunk documentation and Answers, we want to increase the maxThreads and maxSockets value in server.conf. Currently it is set by default as 0 and we do not want to make in unlimited. How do we calculate the optimum value for these two options? What are the factors that should be taken into consideration?

Thanks,
Keerthana

[vliggio]

I know this is an ancient question but figured I'd put in an answer for others...

http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/HTTPthreadlimitissues

[spellanser]

Where is no recommendations, just described the defaults values calculation.