Splunk Search

What is the difference between the "srchJobsQuota" and "cumulativeSrchJobsQuota" settings in the authorize.conf role stanzas?

kwasielewski
Path Finder

What is the difference between the "srchJobsQuota" and the "cumulativeSrchJobsQuota" setting in the authorize.conf role stanzas? Should one or both be used to set the search quota for the role?

Thanks.

1 Solution

Raghav2384
Motivator

Hello,

Let's say i have a role called xyz and cumulative quota is 1000 searches. I then added 4 users to it with a limit for each user for a 100 searches.

So, 4 users can run 400 at a time. If 100 searches per user is a standard, i can add 6 more users to it.

srchJobsQuota =
* Maximum number of concurrently running historical searches a member of this role can have.
* This excludes real-time searches, see rtSrchJobsQuota.
* Defaults to 3.

cumulativeSrchJobsQuota =
* Maximum number of concurrently running historical searches that all members of this role can have.
* NOTE: if a user belongs to multiple roles then s/he will first consume searches from the roles with
* the largest cumulative search quota, when the quota of a role is completely used up then roles
* with lower quotas will be examined.

http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf

Hope this helps!

Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Hello,

Let's say i have a role called xyz and cumulative quota is 1000 searches. I then added 4 users to it with a limit for each user for a 100 searches.

So, 4 users can run 400 at a time. If 100 searches per user is a standard, i can add 6 more users to it.

srchJobsQuota =
* Maximum number of concurrently running historical searches a member of this role can have.
* This excludes real-time searches, see rtSrchJobsQuota.
* Defaults to 3.

cumulativeSrchJobsQuota =
* Maximum number of concurrently running historical searches that all members of this role can have.
* NOTE: if a user belongs to multiple roles then s/he will first consume searches from the roles with
* the largest cumulative search quota, when the quota of a role is completely used up then roles
* with lower quotas will be examined.

http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf

Hope this helps!

Thanks,
Raghav

View solution in original post

kwasielewski
Path Finder

Thank you, that does clarify the difference for me. Do you know what he default value is for the cumulativeSrchJobsQuota is? The authorize spec does not seem to list the value. My roles have a value of "0" set and I am not sure if that is the default or not.

I suspect the "0" value means there is no limit based on what you have described and the way my system is performing.

0 Karma

Raghav2384
Motivator

Correct and i see the reason why it's hard to have a default value for cumulativeSrchJobsQuota

Since srchJobsquota has a defauilt of 3 , adding 6 users to this role kinda have to bump the role quota to 18 🙂

Considering the above 6 user example, if you do not set srchjobsquota but set cumulativequota to let's say 15. Delta is 3 (6 users with default 3 but role permits only 15 concurrent searches) having the 3 get in line.

3 searches jump on to "Queued" section. Hope this help!

Thanks,
Raghav

0 Karma

kwasielewski
Path Finder

That makes sense. Thank you for the quick and concise answers.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!