Splunk Search

What is the maximum number of real-time searches that can be running?

mmilano
Explorer

I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?

Tags (1)
0 Karma

mmilano
Explorer

Thank you!! I increased max_rt_search_multiplier to 8.

mmilano
Explorer

I am running on a 12 core server.

0 Karma

yannK
Splunk Employee
Splunk Employee

As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂

0 Karma

yannK
Splunk Employee
Splunk Employee

Default system limit is defined in limits.conf as Nb_core*4

User limits is defined per role is authorize.conf

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...