Splunk Search

Need help on search parallelization ? How and where to turn on this search parallelization mode?

Hemnaath
Motivator

Hi All, I need to turn on the search parallelization "Batch mode search parallelization" but not sure where I need to configure this setting ? We have distributed Environment with 5 individual Forwarder, 5 individual Indexer, 3 search head cluster and thousands of UF configured.

/opt/splunk/etc/apps/test-app/local/limits.conf
[search]
batch_search_max_pipeline = 1

Whether it should be done on the search head or in Indexer instances. Kindly guide me on this.

Tags (1)
0 Karma

somesoni2
Revered Legend

This is what I read from documentation page : http://docs.splunk.com/Documentation/Splunk/7.0.3/Capacity/Parallelization#Batch_mode_search_paralle...

Adjusting the batch_search_max_pipeline setting in limits.conf to 2 multiplies the IO, processing, and memory used by batch mode searches ***on every indexer****.
0 Karma

Hemnaath
Motivator

Hey I had gone through this document but not sure where we need to apply this stanza in search head or in indexer? So could please guide on this please.

http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch#Configure_batch... link text

0 Karma

somesoni2
Revered Legend

It should be applied on Indexer, on limits.conf.

0 Karma

Hemnaath
Motivator

Can I get any help on this ???

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!