Deployment Architecture

splunk-optimize in multi-instance enviroments

jfraiberg
Communicator

I have an architecture that houses many individual instances of splunk. Occasionally splunk-optimizes will run at the same time for many instances. This causes load spikes. Is there any way to stagger or control when splunk optimizes are run on a per instance basis.

Tags (2)
1 Solution

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

View solution in original post

0 Karma

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

0 Karma

MarioM
Motivator

you might want to open a case to splunk support to see if they have a suggestion

0 Karma

jfraiberg
Communicator

I'm not sure maxConcurrentOptimizes will help in my situation since its single optimizes spanning multiple instances. It seems that a possible ugly solution is to just disable it and cron them staggered but that would take some R&D. I was hoping there was a way to do it natively.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...