Monitoring Splunk

How can I modify Splunk cluster configurations to use CPU effectively on high power systems?

awilcox_splunk
Splunk Employee
Splunk Employee

Can certain Splunk configurations be modified to increase concurrency? Can searches be modified to better use CPU?

0 Karma
1 Solution

awilcox_splunk
Splunk Employee
Splunk Employee

Here are the changes that can be made to increase the concurrency and searches for the 'admin' user:

  1. For user level concurrency, on all Splunk search head nodes add: /opt/splunk/etc/system/local/authorize.conf [role_admin] srchJobsQuota=5000 cumulativeSrchJobsQuota=5000
  2. For Splunk search level concurrency, add the following section to /opt/splunk/etc/system/local/limits.conf on all search head nodes: [search] base_max_searches=192 ttl=60

View solution in original post

0 Karma

awilcox_splunk
Splunk Employee
Splunk Employee

Here are the changes that can be made to increase the concurrency and searches for the 'admin' user:

  1. For user level concurrency, on all Splunk search head nodes add: /opt/splunk/etc/system/local/authorize.conf [role_admin] srchJobsQuota=5000 cumulativeSrchJobsQuota=5000
  2. For Splunk search level concurrency, add the following section to /opt/splunk/etc/system/local/limits.conf on all search head nodes: [search] base_max_searches=192 ttl=60
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...