Splunk Search
Highlighted

Help with limits.conf

Builder

What settings should we change to increase the number of concurrent searches running .Following is the setting that we have nowWe have 4 searches with 40 CPU each .So I assume a total of 184 concurrent searches can be ran .I am continusly getting message saying maximum number of concurrent searches has reached and some of the alerts are getting skipped.

basemaxsearches = 6

The maximum number of concurrent searches per CPU.
maxsearchesper_cpu = 1

Please advice on this .Thanks in advance

0 Karma
Highlighted

Re: Help with limits.conf

Contributor

I would recommend adding more CPUs to your search head before you go adjusting those limits. You'll be happier in the long run.

0 Karma