How can I modify Splunk cluster configurations to use CPU effectively on high power systems?

[awilcox_splunk]

Can certain Splunk configurations be modified to increase concurrency? Can searches be modified to better use CPU?

[awilcox_splunk · Accepted solution]

Here are the changes that can be made to increase the concurrency and searches for the 'admin' user:

1. For user level concurrency, on all Splunk search head nodes add: /opt/splunk/etc/system/local/authorize.conf [role_admin] srchJobsQuota=5000 cumulativeSrchJobsQuota=5000
2. For Splunk search level concurrency, add the following section to /opt/splunk/etc/system/local/limits.conf on all search head nodes: [search] base_max_searches=192 ttl=60