Does Splunk internally know the "numberofcpus" for the below maths?
max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches
I have 2 CPU with 10 cores each for 20 cores, Splunk version 6
So, is the following good, or should i change something?
batch_search_max_pipeline = 2 base_max_searches = 10 max_searches_per_cpu = 1 max_rt_search_multiplier = 2
Yes, only play with those settings if you want to increase the maximum system concurrency limit for searches.
maxrtsearch_multiplier = 2
Is this ok as well?
I am looking to make sure that the 20 cores that i have are optional for the heavy searching that i am doing.
Often i will go to 100% on my BOX as i will have 5 users using my reports, Datamodels over Millions of lines of data...etc..
Splunk can determine the number of available CPU's, however you may wish to run more searches per CPU.
maxsearchesper_cpu can be tweaked as required, I've run in excess of 10 searches per CPU without issue but it would depend on your workload...
In my particular case most of the searches are carefully written and therefore I can have a higher number of searches per CPU.