- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the maximum number of real-time searches that can be running?
mmilano
Explorer
08-22-2012
09:17 AM
I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mmilano
Explorer
08-22-2012
11:21 AM
Thank you!! I increased max_rt_search_multiplier to 8.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mmilano
Explorer
08-22-2012
12:15 PM
I am running on a 12 core server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yannK

Splunk Employee
08-22-2012
12:01 PM
As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yannK

Splunk Employee
08-22-2012
10:29 AM
Default system limit is defined in limits.conf as Nb_core*4
User limits is defined per role is authorize.conf
