Does Splunk internally know the "number_of_cpus" or do I need to set this?

[robertlynch2020]

Does Splunk internally know the "number_of_cpus" for the below maths?

max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches

I have 2 CPU with 10 cores each for 20 cores, Splunk version 6

So, is the following good, or should i change something?

[search]

batch_search_max_pipeline = 2

base_max_searches = 10

max_searches_per_cpu = 1

max_rt_search_multiplier = 2

[gjanders]

Splunk can determine the number of available CPU's, however you may wish to run more searches per CPU.

max_searches_per_cpu can be tweaked as required, I've run in excess of 10 searches per CPU without issue but it would depend on your workload...
In my particular case most of the searches are carefully written and therefore I can have a higher number of searches per CPU.

[robertlynch2020]

cheers --

max_rt_search_multiplier = 2

Is this ok as well?

I am looking to make sure that the 20 cores that i have are optional for the heavy searching that i am doing.
Often i will go to 100% on my BOX as i will have 5 users using my reports, Datamodels over Millions of lines of data...etc..

[bmacias84]

Yes, only play with those settings if you want to increase the maximum system concurrency limit for searches.