- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to configure Splunk to make scheduled searches having a higher priority than ad-hoc searches?
danielbb
Motivator
02-16-2023
10:28 AM
Is there a way to configure Splunk to make scheduled searches having a higher priority than ad-hoc searches?
I know that we can do it using the Workload Management but since we don't use it yet, I hope there is a way to do it without the Workload Management.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jonaclough
Path Finder
02-17-2023
06:53 AM
You can set limits on the relative number of ad-hoc vs scheduled searches that can run on a SH: https://docs.splunk.com/Documentation/Splunk/9.0.4/admin/Limitsconf
The setting max_searches_perc is worth investigating. This will give more room for the scheduled searches to operate. You could also have SHs dedicated to scheduled searches
