Splunk Enterprise

app and limits.conf

human96
Communicator

I want to control the number of concurrent user searches on an app-by-app basis.

I think it is possible to control the number of concurrent executions on a role-by-role basis, but is it possible to control on an app-by-app basis?

If control is possible on an app-by-app basis, please tell me how to control it.

(I think it is feasible by distributing limits.conf (base_max_searches) under App.)

0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Concurrent searches can be controlled using base_max_searches and max_searches_per_cpu. But those are global settings only as mentioned by @isoutamo It would be better to restrict the users based on roles and apply the limits globally. Creating roles based on apps can become a complex job for managing roles, current and future users, current and future apps as well. 

---
If you find the answer helpful, an upvote/karma is appreciated
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Quite many attribute on limits.conf are global not local for app. Also this is global. At least I don’t know any easy way to do it. Basically you could create app based roles which have this value, but if user has many roles then he/she will get the highest value for all apps.

r. Ismo 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...