What is the maximum number of real-time searches t... - Splunk Community

Splunk Search

I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?

Thank you!! I increased max_rt_search_multiplier to 8.

I am running on a 12 core server.

As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂

Default system limit is defined in limits.conf as Nb_core*4

User limits is defined per role is authorize.conf

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...