Splunk Search

What is the significance of the base_max_search constant?

ppuru
Path Finder

Hi Splunkers,

I am aware of the calculation used to arrive at the max concurrent searches that can be executed on a search head.
No. of concurrent searches = max_searches_per_cpu x number_of_cpu's + base_max_searches

Here by default max_searches_per_cpu=1 and base_max_seaches=6

Now, let's consider a 2 CPU SH with 4 cores.
No. of concurrent searches = (1 x (2x4)) + 6 = 14
What I don't understand here is, how can I execute 14 concurrent searches when I only have the capability for 2x4=8 searches? What is the significance of base_max_search constant?

0 Karma
1 Solution

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

View solution in original post

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

ppuru
Path Finder

Holger,
I got your point. Thank you for shedding some light around the mystery.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...