Splunk Search
Highlighted

Does Splunk internally know the "number_of_cpus" or do I need to set this?

Motivator

Does Splunk internally know the "numberofcpus" for the below maths?

max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches

I have 2 CPU with 10 cores each for 20 cores, Splunk version 6

So, is the following good, or should i change something?

[search]

batch_search_max_pipeline = 2

base_max_searches = 10

max_searches_per_cpu = 1

max_rt_search_multiplier = 2
0 Karma
Highlighted

Re: Does Splunk internally know the "number_of_cpus" or do I need to set this?

Champion

Yes, only play with those settings if you want to increase the maximum system concurrency limit for searches.

0 Karma
Highlighted

Re: Does Splunk internally know the "number_of_cpus" or do I need to set this?

Motivator

cheers --

maxrtsearch_multiplier = 2

Is this ok as well?

I am looking to make sure that the 20 cores that i have are optional for the heavy searching that i am doing.
Often i will go to 100% on my BOX as i will have 5 users using my reports, Datamodels over Millions of lines of data...etc..

0 Karma
Highlighted

Re: Does Splunk internally know the "number_of_cpus" or do I need to set this?

SplunkTrust
SplunkTrust

Splunk can determine the number of available CPU's, however you may wish to run more searches per CPU.

maxsearchesper_cpu can be tweaked as required, I've run in excess of 10 searches per CPU without issue but it would depend on your workload...
In my particular case most of the searches are carefully written and therefore I can have a higher number of searches per CPU.

0 Karma