Splunk Search

Total number of searches in limits.conf and authorize.conf: Which option takes precedence?

strive
Influencer

Hi,

System Details:
System Type: Virtual Machine
Total CPUs: 8 vCPUs (4 cores. 4 * 2 = 😎
Total Users: 1

The overridden settings are:
In limits.conf

  • max_searches_per_cpu = 6
  • max_searches_perc=75

In authorize.conf

  • srchJobsQuota = 50

My Questions are:
As per splunk documentation - max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches so max_hist_searches = 6*8+6 = 54. Since max_searches_perc is set as 75. The maximum searches will be 0.75 * 54 = 40

In authorize.conf the search jobs quota is set as 50.

So, the total number of searches that are allowed to run is 40 or 50? Which one takes precedence?

0 Karma

yannK
Splunk Employee
Splunk Employee

The system limit takes precedence over the roles limits in the facts.
if have a high limit in authorize.conf, it does not mean that the system limit will let you use more of the ressources it has,

Remarks, if you raise the multiplicator too high, the risk is that the system will try to cramp more searches on the same number of cores, and you will end up with slower searches, and higher memory usage, and slower i/o for indexing and searching,

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I would guess (and it's only a guess) that the lower value takes precedence. Try it. If you can run more than 40 searches at a time then that would prove me wrong.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...