Splunk Search

multi_threaded_setup parameter in limits.conf

splunkIT
Splunk Employee
Splunk Employee

We are currently looking at improving CPU optimization on the Splunk environment. We have found that the limits.conf contain the following option :

multi_threaded_setup = [0|1]
* Flag indicating whether to use multiple threads when setting up distributed search to multiple peers.
* Defaults to false (0)

I have done tests in the lab on both the search head and the indexer and I can't see any behavior change looking at the threads number. How should we activate this option and is it worth it?

the_wolverine
Champion

We just discovered that the default/limits.conf uses "false" as the value for multi_threaded_setup. Now we wonder if using true/false would not work properly if set in local/limits.conf as per the spec file [0|1].

From default/limits.conf:

whether to use multiple threads when setting up distributed search to multiple peers

multi_threaded_setup = false

0 Karma

splunkIT
Splunk Employee
Splunk Employee

The multi_threaded_setup parameter in limits.conf does not have any direct relation to CPU optimization. This parameter may be helpful for distributed search environment where you have dozens of search PEERS implemented, but in most case this parameter should be left alone. Generally, we don't recommend users to make any modification to the limits.conf file, with the exceptions of some specific cases.

Perhaps this Splunk Answers thread may help in answering your questions in regarding to CPU optimization:

http://splunk-base.splunk.com/answers/12027/singlemulti-threading-cpu

splunkIT
Splunk Employee
Splunk Employee

Search peers/indexers.

multi_threaded_setup = [0|1]
* Flag indicating whether to use multiple threads when setting up distributed search to multiple peers.
* Defaults to false (0)

0 Karma

the_wolverine
Champion

SplunkIT: "This parameter may be helpful for distributed search environment where you have dozens of search heads" Do you mean "search peers" (typically, indexers) OR did you mean search HEADS?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Correct, this parameter only controls multi-threading of the connection establishment to many distributed search peers. Typically the time take for this is negligible, but if you have lots of them it may matter. HOWEVER, due to issues in the SSL libraries that Splunk uses today (September 2012), if you want to use this parameter, you must disable SSL on the search peers splunkd.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...