Reporting

Saved search cause slow and not access in splunk

YUNHYEONG
Explorer

Hello, splunker.

I have about 50 savedsearch.

It's schedule is executed once every 30 minutes and my workstation have 4 core.

So I set it as follows.

[search]
base_max_searches = 24
max_searches_per_cpu = 4

[scheduler]
max_searches_perc = 200

however, my splunk so slow.

I can't access splunk and putty shell

why?

I am splunk novice.

please help me.

thank you.

0 Karma
1 Solution

codebuilder
Influencer

Those settings are way too high for your system.

Try these instead:
[search]
base_max_searches = 6
max_searches_per_cpu = 2

[scheduler]
max_searches_perc = 80

Also make sure that your scheduled searches are not running "all-time" queries, e.g.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

Those settings are way too high for your system.

Try these instead:
[search]
base_max_searches = 6
max_searches_per_cpu = 2

[scheduler]
max_searches_perc = 80

Also make sure that your scheduled searches are not running "all-time" queries, e.g.

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

YUNHYEONG
Explorer

ty your answer but, i will upgrade my server. it is 8 core. how do i set my server?

0 Karma

codebuilder
Influencer

I would suggest testing the parameters I supplied. I think the most important change in your config is the max_searches_perc, which you previously had/have set to 200%. Try the suggested settings then evaluate how your system performs.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

YUNHYEONG
Explorer

thank you. It helped me a lot.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!