Splunk Search

Set max concurrent search for a particular saved search

takashi6
Explorer

Hello community and experts,

Is it possible to set a max concurrent search for a particular saved search?

The use case is that:

  • We have an external system which APIs into Splunk to run a saved search
  • This saved search searches a particular KV Store, return records and update those records
  • There are two instances of this external system
  • We don't want two instances of the external system to access to the KV Store at the same time
  • If we can set a max concurrent search on this particular saved search, we'd set it to 1

Your feedback would be greatly appreciated!

Thanks in advance!

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Probably add also this rtSrchJobsQuota=0 to ensure that no real-time queries is not try to use with this user (with rest, those cannot use anyhow).

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

Not directly, but...

Could you set that API to use a user/role that's specific to it and set that role's concurrent search limit to 1?

takashi6
Explorer

Thanks @Richfez for your advice!

 

Yes, we can create a particular Splunk user and a particular role for this purpose.

Is it possible to specify a concurrent search to a role? would you please be kind enough to point me to relevant splunk doc?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
All capabilities are set to role and then role has given to user/group of users. You can see that on https://docs.splunk.com/Documentation/Splunk/7.3.3/Admin/Authorizeconf
r. Ismo
0 Karma

takashi6
Explorer

Thanks @isoutamo  for your further inputs!

So, if I want a particular API user to be able to run only 1 concurrent search, then I would create a custom role with srchJobsQuota=1 and assign this role to the API user - - - did I get it right?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Probably add also this rtSrchJobsQuota=0 to ensure that no real-time queries is not try to use with this user (with rest, those cannot use anyhow).
0 Karma

takashi6
Explorer

thanks @isoutamo !

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...