Deployment Architecture

concurrent search limit in distributed search

haobin
Explorer

There is a default limit for concurrent search which comes from max_searches_per_cpu x cpu_cores + base_max_searches. That is pretty clear for single node. However, I am coufused about this limit when running distributed searches.

Let's say we have 2 search heads and 4 indexers and the data are separated in 4 indexers averagely. And, each node can have 36 concurrent searches on each node according to the formula above. If I have 60 different and expensive searches running on 2 search heads, 30 for each, at the same time, excluding other limits, what will happen? Will all of them be run?

To simplify my question, does the concurrent search limit apply to all search heads and indexers when running distributed searches? Or just apply to search heads only?

Thanks.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

The concurrency limit applies independently at each search head only. This means that any individual indexer could have as many concurrent jobs as the product of the per-search head limit and the number of search heads. However, this is unlikely to be a problem in most deployments since the load factor on each indexer is less than one per search.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...