Splunk Search

Need help on search parallelization ? How and where to turn on this search parallelization mode?

Hemnaath
Motivator

Hi All, I need to turn on the search parallelization "Batch mode search parallelization" but not sure where I need to configure this setting ? We have distributed Environment with 5 individual Forwarder, 5 individual Indexer, 3 search head cluster and thousands of UF configured.

/opt/splunk/etc/apps/test-app/local/limits.conf
[search]
batch_search_max_pipeline = 1

Whether it should be done on the search head or in Indexer instances. Kindly guide me on this.

Tags (1)
0 Karma

somesoni2
Revered Legend

This is what I read from documentation page : http://docs.splunk.com/Documentation/Splunk/7.0.3/Capacity/Parallelization#Batch_mode_search_paralle...

Adjusting the batch_search_max_pipeline setting in limits.conf to 2 multiplies the IO, processing, and memory used by batch mode searches ***on every indexer****.
0 Karma

Hemnaath
Motivator

Hey I had gone through this document but not sure where we need to apply this stanza in search head or in indexer? So could please guide on this please.

http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Configurebatchmodesearch#Configure_batch... link text

0 Karma

somesoni2
Revered Legend

It should be applied on Indexer, on limits.conf.

0 Karma

Hemnaath
Motivator

Can I get any help on this ???

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!