Deployment Architecture

splunk-optimize in multi-instance enviroments

jfraiberg
Communicator

I have an architecture that houses many individual instances of splunk. Occasionally splunk-optimizes will run at the same time for many instances. This causes load spikes. Is there any way to stagger or control when splunk optimizes are run on a per instance basis.

Tags (2)
1 Solution

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

View solution in original post

0 Karma

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

0 Karma

MarioM
Motivator

you might want to open a case to splunk support to see if they have a suggestion

0 Karma

jfraiberg
Communicator

I'm not sure maxConcurrentOptimizes will help in my situation since its single optimizes spanning multiple instances. It seems that a possible ugly solution is to just disable it and cron them staggered but that would take some R&D. I was hoping there was a way to do it natively.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...