Splunk Enterprise

Add CPU cores and changing limits.conf ?

mikefg
Path Finder

I will be adding CPU cores to my search head (virtual). After I have added the cores, do I need to manually update limits.conf? Currently at 8 cores, going to 12 or 16. limilts.conf is currently using defaults.

# The base number of concurrent searches.
base_max_searches = 6

# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 1

# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 1

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @mikefg,

You don't need to change these parameters, max concurrent search number is calculated dynamically using below formula. When you add cpu Splunk will take new number of PCU count and 

Maximum number of concurrent historical searches = (max_searches_per_cpu * number of CPU) + base_max_searches

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote is appreciated.
0 Karma