Deployment Architecture

splunk-optimize in multi-instance enviroments

jfraiberg
Communicator

I have an architecture that houses many individual instances of splunk. Occasionally splunk-optimizes will run at the same time for many instances. This causes load spikes. Is there any way to stagger or control when splunk optimizes are run on a per instance basis.

Tags (2)
1 Solution

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

View solution in original post

0 Karma

MarioM
Motivator

You can alter the number of concurrent instances of splunk-optimize by changing the value set for maxConcurrentOptimizes in indexes.conf but i dont think you can tell him when to run
outside forcing it to run via ./splunk-optimize <directory>

0 Karma

MarioM
Motivator

you might want to open a case to splunk support to see if they have a suggestion

0 Karma

jfraiberg
Communicator

I'm not sure maxConcurrentOptimizes will help in my situation since its single optimizes spanning multiple instances. It seems that a possible ugly solution is to just disable it and cron them staggered but that would take some R&D. I was hoping there was a way to do it natively.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...