Total number of searches in limits.conf and authorize.conf: Which option takes precedence?

[strive]

Hi,

System Details:
System Type: Virtual Machine
Total CPUs: 8 vCPUs (4 cores. 4 * 2 = 😎
Total Users: 1

The overridden settings are:
In limits.conf

• max_searches_per_cpu = 6
• max_searches_perc=75

In authorize.conf

• srchJobsQuota = 50

My Questions are:
As per splunk documentation - max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches so max_hist_searches = 6*8+6 = 54. Since max_searches_perc is set as 75. The maximum searches will be 0.75 * 54 = 40

In authorize.conf the search jobs quota is set as 50.

So, the total number of searches that are allowed to run is 40 or 50? Which one takes precedence?

[yannK]

The system limit takes precedence over the roles limits in the facts.
if have a high limit in authorize.conf, it does not mean that the system limit will let you use more of the ressources it has,

Remarks, if you raise the multiplicator too high, the risk is that the system will try to cramp more searches on the same number of cores, and you will end up with slower searches, and higher memory usage, and slower i/o for indexing and searching,

[richgalloway]

I would guess (and it's only a guess) that the lower value takes precedence. Try it. If you can run more than 40 searches at a time then that would prove me wrong.