Splunk Search
Highlighted

Need help on search parallelization ? How and where to turn on this search parallelization mode?

Motivator

Hi All, I need to turn on the search parallelization "Batch mode search parallelization" but not sure where I need to configure this setting ? We have distributed Environment with 5 individual Forwarder, 5 individual Indexer, 3 search head cluster and thousands of UF configured.

/opt/splunk/etc/apps/test-app/local/limits.conf
[search]
batchsearchmax_pipeline = 1

Whether it should be done on the search head or in Indexer instances. Kindly guide me on this.

Tags (1)
0 Karma
Highlighted

Re: Need help on search parallelization ? How and where to turn on this search parallelization mode?

Motivator

Can I get any help on this ???

0 Karma
Highlighted

Re: Need help on search parallelization ? How and where to turn on this search parallelization mode?

SplunkTrust
SplunkTrust

This is what I read from documentation page : http://docs.splunk.com/Documentation/Splunk/7.0.3/Capacity/Parallelization#Batch_mode_search_paralle...

Adjusting the batch_search_max_pipeline setting in limits.conf to 2 multiplies the IO, processing, and memory used by batch mode searches ***on every indexer****.
0 Karma
Highlighted

Re: Need help on search parallelization ? How and where to turn on this search parallelization mode?

Motivator

Hey I had gone through this document but not sure where we need to apply this stanza in search head or in indexer? So could please guide on this please.

http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch#Configure_batch... link text

0 Karma
Highlighted

Re: Need help on search parallelization ? How and where to turn on this search parallelization mode?

SplunkTrust
SplunkTrust

It should be applied on Indexer, on limits.conf.

0 Karma