foreach and server limits

[PickleRick]

I was wondering... how are foreach-generated searches treated regarding the searches limits?

I mean - normally you have your maximum number of concurrent searches set in your limits.conf - it can affect how/when/where your searches will be scheduled to run and can generate alerts in case of too many delayed searches. Fair enough.

But how are subsearches spawned from foreach command counted against the limit?

If I do a foreach over - let's say - 50 fields, will it consume 50 searches? Will they be all run in parallel or will they be sequenced somehow?

Any good doc describing this?

[isoutamo]

Hi

I haven't seen any specific documentation about this, but what I have understood is that those are not sub searches, which are counted as separate searches. You can see this by two different searches (foreach and another with sub search). 1st one didn't spawn another search job but 2nd one with sub search spawn it. Just look those from Activity -> jobs

r. Ismo

[PickleRick]

The "normal" job inspection doesn't show much of a difference at first glance but I forgot to check the job log. When I did look there, indeed there's no info about spawning subsearches in case of foreach whereas a "real" subsearch does indeed contain

09-30-2021 14:14:45.012 INFO  DispatchStorageManagerInfo [4926 searchOrchestrator] - Successfully created new dispatch directory for search job. sid=subsearch_1633004084.7924_1633004085.1 dispatch_dir=/opt/splunk/var/run/splunk/dispatch/subsearch_1633004084.7924_1633004085.1

 Thanks for the hint.