Recommended maximum concurrent searches?

[ankithreddy777]

whats the recommended maximum concurrent searches overall can be performed if we have 40 indexers in a cluster. There are 10 search heads.

[DavidHourani]

did you get an answer to your question ?

[s2_splunk]

The answer to that significantly depends on your average search execution time (which depends on search complexity and event distribution) and the number of cores you have in both, search heads and indexers.

In other words, we can't really answer this question without knowing these things.

[ankithreddy777]

May I get an rough estimation.
Average search time 30 secs with simple searches for statistics.
number of cpus=24 on search heads and indexers
indexers =40 in a cluster
search heads = 10

What can be the rough estimate of Max concurrent searches can be performed indexers using SH.

[s2_splunk]

Your search head tier has the capacity to produce 300 concurrent searches (with default settings, i.e. #of cores+6).
If those are 24 physical cores with hyperthreading enabled, make that 540 concurrent searches (48+6*10).
So that's your maximum theoretical concurrent search load the search tier can produce.

Whether your indexers can handle that depends on how quickly each indexer can complete its part of each search. A lot will depend on your search type, time frames, disk I/O speed, event distribution, etc.
Any rough estimate would largely be a best guess and of limited use.

30 seconds for a "simple search for statistics" seems a lot, btw.