Splunk Search

What is the difference between the "srchJobsQuota" and "cumulativeSrchJobsQuota" settings in the authorize.conf role stanzas?

kwasielewski
Path Finder

What is the difference between the "srchJobsQuota" and the "cumulativeSrchJobsQuota" setting in the authorize.conf role stanzas? Should one or both be used to set the search quota for the role?

Thanks.

1 Solution

Raghav2384
Motivator

Hello,

Let's say i have a role called xyz and cumulative quota is 1000 searches. I then added 4 users to it with a limit for each user for a 100 searches.

So, 4 users can run 400 at a time. If 100 searches per user is a standard, i can add 6 more users to it.

srchJobsQuota =
* Maximum number of concurrently running historical searches a member of this role can have.
* This excludes real-time searches, see rtSrchJobsQuota.
* Defaults to 3.

cumulativeSrchJobsQuota =
* Maximum number of concurrently running historical searches that all members of this role can have.
* NOTE: if a user belongs to multiple roles then s/he will first consume searches from the roles with
* the largest cumulative search quota, when the quota of a role is completely used up then roles
* with lower quotas will be examined.

http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf

Hope this helps!

Thanks,
Raghav

View solution in original post

Raghav2384
Motivator

Hello,

Let's say i have a role called xyz and cumulative quota is 1000 searches. I then added 4 users to it with a limit for each user for a 100 searches.

So, 4 users can run 400 at a time. If 100 searches per user is a standard, i can add 6 more users to it.

srchJobsQuota =
* Maximum number of concurrently running historical searches a member of this role can have.
* This excludes real-time searches, see rtSrchJobsQuota.
* Defaults to 3.

cumulativeSrchJobsQuota =
* Maximum number of concurrently running historical searches that all members of this role can have.
* NOTE: if a user belongs to multiple roles then s/he will first consume searches from the roles with
* the largest cumulative search quota, when the quota of a role is completely used up then roles
* with lower quotas will be examined.

http://docs.splunk.com/Documentation/Splunk/6.0.6/Admin/authorizeconf

Hope this helps!

Thanks,
Raghav

kwasielewski
Path Finder

Thank you, that does clarify the difference for me. Do you know what he default value is for the cumulativeSrchJobsQuota is? The authorize spec does not seem to list the value. My roles have a value of "0" set and I am not sure if that is the default or not.

I suspect the "0" value means there is no limit based on what you have described and the way my system is performing.

0 Karma

Raghav2384
Motivator

Correct and i see the reason why it's hard to have a default value for cumulativeSrchJobsQuota

Since srchJobsquota has a defauilt of 3 , adding 6 users to this role kinda have to bump the role quota to 18 🙂

Considering the above 6 user example, if you do not set srchjobsquota but set cumulativequota to let's say 15. Delta is 3 (6 users with default 3 but role permits only 15 concurrent searches) having the 3 get in line.

3 searches jump on to "Queued" section. Hope this help!

Thanks,
Raghav

0 Karma

kwasielewski
Path Finder

That makes sense. Thank you for the quick and concise answers.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...