Splunk Search

Recommended maximum concurrent searches?

ankithreddy777
Contributor

whats the recommended maximum concurrent searches overall can be performed if we have 40 indexers in a cluster. There are 10 search heads.

0 Karma

DavidHourani
Super Champion

did you get an answer to your question ?

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The answer to that significantly depends on your average search execution time (which depends on search complexity and event distribution) and the number of cores you have in both, search heads and indexers.

In other words, we can't really answer this question without knowing these things.

ankithreddy777
Contributor

May I get an rough estimation.
Average search time 30 secs with simple searches for statistics.
number of cpus=24 on search heads and indexers
indexers =40 in a cluster
search heads = 10

What can be the rough estimate of Max concurrent searches can be performed indexers using SH.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Your search head tier has the capacity to produce 300 concurrent searches (with default settings, i.e. #of cores+6).
If those are 24 physical cores with hyperthreading enabled, make that 540 concurrent searches (48+6*10).
So that's your maximum theoretical concurrent search load the search tier can produce.

Whether your indexers can handle that depends on how quickly each indexer can complete its part of each search. A lot will depend on your search type, time frames, disk I/O speed, event distribution, etc.
Any rough estimate would largely be a best guess and of limited use.

30 seconds for a "simple search for statistics" seems a lot, btw.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...