Deployment Architecture

concurrent search limit in distributed search

haobin
Explorer

There is a default limit for concurrent search which comes from max_searches_per_cpu x cpu_cores + base_max_searches. That is pretty clear for single node. However, I am coufused about this limit when running distributed searches.

Let's say we have 2 search heads and 4 indexers and the data are separated in 4 indexers averagely. And, each node can have 36 concurrent searches on each node according to the formula above. If I have 60 different and expensive searches running on 2 search heads, 30 for each, at the same time, excluding other limits, what will happen? Will all of them be run?

To simplify my question, does the concurrent search limit apply to all search heads and indexers when running distributed searches? Or just apply to search heads only?

Thanks.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

The concurrency limit applies independently at each search head only. This means that any individual indexer could have as many concurrent jobs as the product of the per-search head limit and the number of search heads. However, this is unlikely to be a problem in most deployments since the load factor on each indexer is less than one per search.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...