Deployment Architecture
Highlighted

What is the optimum value for maxThreads and maxSockets when configuring server.conf?

Communicator

Hi,

We have a Splunk distributed deployment with indexer clustering. We are currently exposing a Splunk app in the search head through REST and using it to fetch results and display in another application. We are currently running about 50 searches every 5 minutes.

However, we find that after a while the Splunk daemon stops responding to requests even though it shows running status. On debugging this issue and going through Splunk documentation and Answers, we want to increase the maxThreads and maxSockets value in server.conf. Currently it is set by default as 0 and we do not want to make in unlimited. How do we calculate the optimum value for these two options? What are the factors that should be taken into consideration?

Thanks,
Keerthana

0 Karma
Highlighted

Re: What is the optimum value for maxThreads and maxSockets when configuring server.conf?

Communicator

I know this is an ancient question but figured I'd put in an answer for others...

http://docs.splunk.com/Documentation/Splunk/7.0.3/Troubleshooting/HTTPthreadlimitissues

0 Karma
Highlighted

Re: What is the optimum value for maxThreads and maxSockets when configuring server.conf?

Explorer

Where is no recommendations, just described the defaults values calculation.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.