Splunk Search

Why was the maximum number of real time concurrent searches not increased?

DonaldvdHoogenb
Path Finder

Hi fellow splunkers,

I have multiple search heads on which I want to increase the maximum number of (historical and) real time concurrent searches.
I have checked splunk answers on how to do it, and changed the limits.conf in the .../etc/system/local folder of Splunk on every search head. I put the following code in the limits.conf file: base_max_searches = 24. Since the standard number of base_max_searches is 6, I thought an increase in the concurrency of 18 historical and/or real time searches would happen.

However, this was not the case, since I still had 14 concurrent searches. Then I thought, it would have to be a user limit or maybe a role limit, so I checked the concurrency with two different users (both admin priveleges) and assigned extra concurrent searches to a role, but both did not increase the maximum concurrency.

Does anyone have an idea what I did wrong or how I can increase the concurrency of both historical as well as real time searches?

0 Karma

inventsekar
Super Champion

can you run this for last 24hrs (or one or two hrs before you made that base_max_searches change ) and check how many active_hist_searches and active_realtime_searches are there..

  index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches
PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

DonaldvdHoogenb
Path Finder

I do not know for sure how that will help me. The historical searches are very fluctuating over the entire time period (between 0 and 20) while when I had the real-time dashboard open the real time searches were between 10 to 15 before the change and also 10 to 15 after the change. So it looks like my adjustment of the limits.conf did nothing (even though I performed a restart of the search heads after adjusting it).

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...