Splunk Cloud

Concurrent search limits question

rgreer
Path Finder

We are currently evaluating Splunk's cloud offering and the topic of concurrent searches has come up.  This is a bit of a concern for our team as one of the things we'd like to leverage Splunk for is alerting for various systems throughout our environment.  We're expecting around 200+ various alerts running at various intervals.  I'm assuming that we cannot be the only folks wanting to utilize Splunk this way within the cloud.  

I wanted to ask the community if the concurrent limits within Splunk Cloud are ever really an issue.  We've gone round and round with our sells engineer on if this is an issue and he's mentioned that the solution will scale with the amount we index but we're not 100% convinced this solves the problem. 

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

View solution in original post

rgreer
Path Finder

Thanks, this is pretty much where I landed in my research. 

0 Karma

scelikok
Champion

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!