Splunk Search

Why is the REST API bringing back default configuration values?

danielbb
Motivator

The REST API seems to return default values for max_searches_per_cpu, while the btool command brings back the actual values.

 

 

| rest splunk_server=* /services/search/concurrency-settings/search 
| table * 

 

 

Any thoughts?

 

Tags (1)
0 Karma

yeahnah
Motivator

Hi @danielbb 

Strange, it matched for me OK (v8.2.7)

btool query

 splunk btool limits list --debug | grep max_searches_per_cpu

Splunk query

| rest splunk_server=* /services/search/concurrency-settings/search 
| stats max(max_searches_per_cpu) BY splunk_server

 Have you recently made a change to this setting?

0 Karma
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...