Splunk Search
Highlighted

Why was the maximum number of real time concurrent searches not increased?

Path Finder

Hi fellow splunkers,

I have multiple search heads on which I want to increase the maximum number of (historical and) real time concurrent searches.
I have checked splunk answers on how to do it, and changed the limits.conf in the .../etc/system/local folder of Splunk on every search head. I put the following code in the limits.conf file: base_max_searches = 24. Since the standard number of basemaxsearches is 6, I thought an increase in the concurrency of 18 historical and/or real time searches would happen.

However, this was not the case, since I still had 14 concurrent searches. Then I thought, it would have to be a user limit or maybe a role limit, so I checked the concurrency with two different users (both admin priveleges) and assigned extra concurrent searches to a role, but both did not increase the maximum concurrency.

Does anyone have an idea what I did wrong or how I can increase the concurrency of both historical as well as real time searches?

0 Karma
Highlighted

Re: Why was the maximum number of real time concurrent searches not increased?

Champion

can you run this for last 24hrs (or one or two hrs before you made that basemaxsearches change ) and check how many activehistsearches and activerealtimesearches are there..

  index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches
Highlighted

Re: Why was the maximum number of real time concurrent searches not increased?

Path Finder

I do not know for sure how that will help me. The historical searches are very fluctuating over the entire time period (between 0 and 20) while when I had the real-time dashboard open the real time searches were between 10 to 15 before the change and also 10 to 15 after the change. So it looks like my adjustment of the limits.conf did nothing (even though I performed a restart of the search heads after adjusting it).

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.