Is it possible for squash_threshold to increase value, and are there consequences?

[AntoineDRN]

Hello Splunkers,

I would like to have a better insight on my license usage, but the "Squash_threshold" default conf is not enough. I have been looking here if there were answers, sadly there are few answers and the rare that exist are a little old.

In the documentation, it is said to ask to a Splunk expert, my contact being in holidays yet, I would like to try to move forward anyways. 

So have you any recommendations on this setting and the possible consequences if I increase it?

Thanks in advance, 

Best regards,

[nspaitsec]

Hello

On which node did they advised to set this parameter ?

on the License Manager and/or any other node ?

Thank you.

[splunkreal]

Hi @nspaitsec license manager and clustered indexers 

[splunkreal]

Hello, is this solved?

Support can help you.

This may increase load on your indexers.

[AntoineDRN]

Hello @splunkreal,

thanks for replying to this it was really out of my mind. 

I reached the support about it, and the conclusion was that it is possible. The best way to increase the parameter is to do it gradually and monitor the effects on the platform.

Regards