What is a suggested max concurrent search?

[clyde772]

Hi gurus,

What is the max concurrent search we can configure on an indexer? and what would be a suggested number of concurrent search on an indexer? What are some of the consideration for maximizing the number of concurrent search? CPU or memory?

I appreciate experts with big splunk deployments.

Thanks.

[yannK]

The maximum system limit is defined in limits.conf and depends of the number of cores,
then, you have the max concurrent searches per user based on the role, but ultimately, the system limits will kick in.

please read the specifications :
http://docs.splunk.com/Documentation/Splunk/4.3.3/Admin/Limitsconf

to resume the default system limits:

historical searches : 4 + nb_cores*4

realtime searches : nb_cores*4

For memory limits, it depends of your searches, and the duration of them, so no rule of thumb there.