Splunk Search

What is the maximum number of real-time searches that can be running?

mmilano
Explorer

I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?

Tags (1)
0 Karma

mmilano
Explorer

Thank you!! I increased max_rt_search_multiplier to 8.

mmilano
Explorer

I am running on a 12 core server.

0 Karma

yannK
Splunk Employee
Splunk Employee

As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂

0 Karma

yannK
Splunk Employee
Splunk Employee

Default system limit is defined in limits.conf as Nb_core*4

User limits is defined per role is authorize.conf

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...