Splunk Search

Can you help me set the concurrency limit in limits.conf?


The concurrency limit is set to five based on the below log.
We are using a 4 core CPU, and according to the limits.conf, shouldn't the limit be 10 concurrent searches(6+4*1)?

Base_max_searches = 6
cpu cores = 4
max_searches_per_cpu = 1

Can anyone explain why the concurrency limit is set as 5 and not 10.

01-29-2019 18:19:00.450 -0600 INFO  SavedSplunker - savedsearch_id="nobody;search;JBoss7 OutOfMemory Alert", search_type="scheduled", user="329421", app="search", savedsearch_name="JBoss7 OutOfMemory Alert", priority=default, status=skipped, reason="The maximum number of concurrent historical scheduled searches on this instance has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_instance-wide", **concurrency_limit=5**, scheduled_time=1548807480, window_time=0
0 Karma


Because it's a scheduled search:

( from Splunk Answers: https://answers.splunk.com/answers/270544/how-to-calculate-splunk-search-concurrency-limit-f.html )

How Many scheduled searches can be run concurrently?
Attribute: 50% of max historical searches (max_searches_perc = 50)

max scheduled historical searches = max_searches_perc x max_hist_searches

5(max_hist_scheduled_searches) = 0.5(max_searches_perc / 100) x 10(max_hist_searches)

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!