Splunk Search

Why is the REST API bringing back default configuration values?

danielbb
Motivator

The REST API seems to return default values for max_searches_per_cpu, while the btool command brings back the actual values.

 

 

| rest splunk_server=* /services/search/concurrency-settings/search 
| table * 

 

 

Any thoughts?

 

Tags (1)
0 Karma

yeahnah
Motivator

Hi @danielbb 

Strange, it matched for me OK (v8.2.7)

btool query

 splunk btool limits list --debug | grep max_searches_per_cpu

Splunk query

| rest splunk_server=* /services/search/concurrency-settings/search 
| stats max(max_searches_per_cpu) BY splunk_server

 Have you recently made a change to this setting?

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...