Monitoring Splunk

How can I modify Splunk cluster configurations to use CPU effectively on high power systems?

awilcox_splunk
Splunk Employee
Splunk Employee

Can certain Splunk configurations be modified to increase concurrency? Can searches be modified to better use CPU?

0 Karma
1 Solution

awilcox_splunk
Splunk Employee
Splunk Employee

Here are the changes that can be made to increase the concurrency and searches for the 'admin' user:

  1. For user level concurrency, on all Splunk search head nodes add: /opt/splunk/etc/system/local/authorize.conf [role_admin] srchJobsQuota=5000 cumulativeSrchJobsQuota=5000
  2. For Splunk search level concurrency, add the following section to /opt/splunk/etc/system/local/limits.conf on all search head nodes: [search] base_max_searches=192 ttl=60

View solution in original post

0 Karma

awilcox_splunk
Splunk Employee
Splunk Employee

Here are the changes that can be made to increase the concurrency and searches for the 'admin' user:

  1. For user level concurrency, on all Splunk search head nodes add: /opt/splunk/etc/system/local/authorize.conf [role_admin] srchJobsQuota=5000 cumulativeSrchJobsQuota=5000
  2. For Splunk search level concurrency, add the following section to /opt/splunk/etc/system/local/limits.conf on all search head nodes: [search] base_max_searches=192 ttl=60
0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...