Splunk Cloud Platform

Concurrent search limits question

rgreer
Path Finder

We are currently evaluating Splunk's cloud offering and the topic of concurrent searches has come up.  This is a bit of a concern for our team as one of the things we'd like to leverage Splunk for is alerting for various systems throughout our environment.  We're expecting around 200+ various alerts running at various intervals.  I'm assuming that we cannot be the only folks wanting to utilize Splunk this way within the cloud.  

I wanted to ask the community if the concurrent limits within Splunk Cloud are ever really an issue.  We've gone round and round with our sells engineer on if this is an issue and he's mentioned that the solution will scale with the amount we index but we're not 100% convinced this solves the problem. 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

rgreer
Path Finder

Thanks, this is pretty much where I landed in my research. 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @rgreer,

Splunk Cloud manages resources according to ingestion capacity. You can check below documents and make a guess if concurrent limits will be an issue or not. While lower than 50 GB/day ingestion gives 20 concurrent searches, 50GB/day to 1TB/day your limits will start with 38. And if you are planning to use premium app like Enterprise Security or ITSI, you will have extra search capacity.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_p...

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Service/SplunkCloudservice#Splunk_Cloud_s...

You should schedule 200+ various alerts carefully to have lower search concurrency. I mean schedules like every 5 min, every 10 min, every 15min etc will cause concurrency top at every beginning an hour. That is why using cron schedules like  "*/2 * * * *" or "1-59/2 * * * *" will help.

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...