Splunk Search

Can you help me set the concurrency limit in limits.conf?

pdantuuri0411
Explorer

The concurrency limit is set to five based on the below log.
We are using a 4 core CPU, and according to the limits.conf, shouldn't the limit be 10 concurrent searches(6+4*1)?

Base_max_searches = 6
cpu cores = 4
max_searches_per_cpu = 1

Can anyone explain why the concurrency limit is set as 5 and not 10.

01-29-2019 18:19:00.450 -0600 INFO  SavedSplunker - savedsearch_id="nobody;search;JBoss7 OutOfMemory Alert", search_type="scheduled", user="329421", app="search", savedsearch_name="JBoss7 OutOfMemory Alert", priority=default, status=skipped, reason="The maximum number of concurrent historical scheduled searches on this instance has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_instance-wide", **concurrency_limit=5**, scheduled_time=1548807480, window_time=0
0 Karma

BainM
Communicator

Because it's a scheduled search:

( from Splunk Answers: https://answers.splunk.com/answers/270544/how-to-calculate-splunk-search-concurrency-limit-f.html )

How Many scheduled searches can be run concurrently?
Attribute: 50% of max historical searches (max_searches_perc = 50)

max scheduled historical searches = max_searches_perc x max_hist_searches

5(max_hist_scheduled_searches) = 0.5(max_searches_perc / 100) x 10(max_hist_searches)

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...