Splunk Search

What is the maximum number of real-time searches that can be running?

mmilano
Explorer

I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?

Tags (1)
0 Karma

mmilano
Explorer

Thank you!! I increased max_rt_search_multiplier to 8.

mmilano
Explorer

I am running on a 12 core server.

0 Karma

yannK
Splunk Employee
Splunk Employee

As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂

0 Karma

yannK
Splunk Employee
Splunk Employee

Default system limit is defined in limits.conf as Nb_core*4

User limits is defined per role is authorize.conf

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...