Splunk Cloud Platform

Concurrent search limits question

rgreer
Path Finder

We are currently evaluating Splunk's cloud offering and the topic of concurrent searches has come up.  This is a bit of a concern for our team as one of the things we'd like to leverage Splunk for is alerting for various systems throughout our environment.  We're expecting around 200+ various alerts running at various intervals.  I'm assuming that we cannot be the only folks wanting to utilize Splunk this way within the cloud.  

I wanted to ask the community if the concurrent limits within Splunk Cloud are ever really an issue.  We've gone round and round with our sells engineer on if this is an issue and he's mentioned that the solution will scale with the amount we index but we're not 100% convinced this solves the problem. 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

rgreer
Path Finder

Thanks, this is pretty much where I landed in my research. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...