Splunk Search

Is there a parameter that limits the number of real-time alerts?

New Member

Hi

We are trying to alert based on different conditions for different application log data. We see in the activity that there are only 5-6 jobs running concurrently while we have 50 alerts configured. Cpu utilization on the search head is very minimum, Concurrent. Can you please tell me if there is parameter which puts a limit on the number or real-time alerts?

Thanks

0 Karma

Splunk Employee
Splunk Employee

yes. it's a mix of

  • the system limits (default is number for cores1 + 6) and a multiplier for realtime (1) > ( cpu * maxsearchespercpu + basemaxsearches ) * maxrtsearchmultiplier

example : 32 cores search-head : (32 *1 +6 ) *1 = 38

  • and your role quota limit for realtime searches, and a multiplier for the scheduled searches.

quota limit rtSrchJobsQuota * maxsearchesperc
example : for a role A: realtime limit 6 and scheduler multiplier 50% => 6 realtime alerts and 3 realtime scheduler max

see limits.conf http://docs.splunk.com/Documentation/Splunk/6.3.3/Admin/Limitsconf

[search]
basemaxsearches, maxsearchespercpu, maxrtsearchmultiplier
[scheduler]

maxsearchesperc

and authorize.conf for the roles quotas. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf
[role_*]
rtSrchJobsQuota

0 Karma