Deployment Architecture

concurrent search limit in distributed search

Explorer

There is a default limit for concurrent search which comes from max_searches_per_cpu x cpu_cores + base_max_searches. That is pretty clear for single node. However, I am coufused about this limit when running distributed searches.

Let's say we have 2 search heads and 4 indexers and the data are separated in 4 indexers averagely. And, each node can have 36 concurrent searches on each node according to the formula above. If I have 60 different and expensive searches running on 2 search heads, 30 for each, at the same time, excluding other limits, what will happen? Will all of them be run?

To simplify my question, does the concurrent search limit apply to all search heads and indexers when running distributed searches? Or just apply to search heads only?

Thanks.

Tags (1)

Splunk Employee
Splunk Employee

The concurrency limit applies independently at each search head only. This means that any individual indexer could have as many concurrent jobs as the product of the per-search head limit and the number of search heads. However, this is unlikely to be a problem in most deployments since the load factor on each indexer is less than one per search.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!