What is the difference between the "srchJobsQuota" and "cumulativeSrchJobsQuota" settings in the authorize.conf role stanzas?

[kwasielewski]

What is the difference between the "srchJobsQuota" and the "cumulativeSrchJobsQuota" setting in the authorize.conf role stanzas? Should one or both be used to set the search quota for the role?

Thanks.

[Raghav2384 · Accepted solution]

Hello,

Let's say i have a role called xyz and cumulative quota is 1000 searches. I then added 4 users to it with a limit for each user for a 100 searches.

So, 4 users can run 400 at a time. If 100 searches per user is a standard, i can add 6 more users to it.

srchJobsQuota =
* Maximum number of concurrently running historical searches a member of this role can have.
* This excludes real-time searches, see rtSrchJobsQuota.
* Defaults to 3.

cumulativeSrchJobsQuota =
* Maximum number of concurrently running historical searches that all members of this role can have.
* NOTE: if a user belongs to multiple roles then s/he will first consume searches from the roles with
* the largest cumulative search quota, when the quota of a role is completely used up then roles
* with lower quotas will be examined.

http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf

Hope this helps!

Thanks,
Raghav

[kwasielewski]

Thank you, that does clarify the difference for me. Do you know what he default value is for the cumulativeSrchJobsQuota is? The authorize spec does not seem to list the value. My roles have a value of "0" set and I am not sure if that is the default or not.

I suspect the "0" value means there is no limit based on what you have described and the way my system is performing.

[Raghav2384]

Correct and i see the reason why it's hard to have a default value for cumulativeSrchJobsQuota

Since srchJobsquota has a defauilt of 3 , adding 6 users to this role kinda have to bump the role quota to 18 🙂

Considering the above 6 user example, if you do not set srchjobsquota but set cumulativequota to let's say 15. Delta is 3 (6 users with default 3 but role permits only 15 concurrent searches) having the 3 get in line.

3 searches jump on to "Queued" section. Hope this help!

Thanks,
Raghav

[kwasielewski]

That makes sense. Thank you for the quick and concise answers.