Deployment Architecture

splunk-optimize in multi-instance enviroments

jfraiberg
Communicator

I have an architecture that houses many individual instances of splunk. Occasionally splunk-optimizes will run at the same time for many instances. This causes load spikes. Is there any way to stagger or control when splunk optimizes are run on a per instance basis.

Tags (2)
1 Solution

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

View solution in original post

0 Karma

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

0 Karma

MarioM
Motivator

you might want to open a case to splunk support to see if they have a suggestion

0 Karma

jfraiberg
Communicator

I'm not sure maxConcurrentOptimizes will help in my situation since its single optimizes spanning multiple instances. It seems that a possible ugly solution is to just disable it and cron them staggered but that would take some R&D. I was hoping there was a way to do it natively.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...