Max Amount of Correlation Searches in Splunk Enterprise Security

[lugoon]

How can you determine the number of correlation searches instances of Splunk Security can handle? For both Splunk Enterprise on prem and Splunk Enterprise in the Cloud. And yes i am taling about active and non-active correlation searches in Splunk. Please also let me know if you want to contact me with further questions!

Thanks!

[PickleRick]

While there might be some technical theoretical limit to the number of correlation searches you can configure in Splunk (if not for any other reason - you can't make more searches that would fill your whole disk with savedsearches.conf - but that's a ridiculous idea for a limit, you'll most likely get into problems much earlier. But the "allowability" of certain number of searches heavily depends on the quantity and quality of your data and on the searches themselves (how they are written, how much time they search and so on). And of course how many searches you can run (both in parallel as well as generally total number across the whole day/week/month/whatever) depends on your environment specs.

So the only reasonable answer is "it depends".