Can I increase the number of backfill threads higher than 16

[approachct]

Is there a way to increase the number of maximum threads that the backfill script will use to a value higher than 16?

[gkanapathy]

You could simply edit or copy and edit the fill_summary_index.py script by hand. However, you will still be limited by settings for the max number of concurrent search jobs in the Splunk server set in limits.conf. These vary depending on the number of CPU cores you have and by default is 4+(4*n_cores), but you can edit these parameters as well. If your machine has

• More than 16 CPU cores, and
• Pretty high disk IOPs

you can get through the jobs faster. Otherwise, you'll bottleneck on one of these resources.