Splunk Search

What is the significance of the base_max_search constant?

ppuru
Path Finder

Hi Splunkers,

I am aware of the calculation used to arrive at the max concurrent searches that can be executed on a search head.
No. of concurrent searches = max_searches_per_cpu x number_of_cpu's + base_max_searches

Here by default max_searches_per_cpu=1 and base_max_seaches=6

Now, let's consider a 2 CPU SH with 4 cores.
No. of concurrent searches = (1 x (2x4)) + 6 = 14
What I don't understand here is, how can I execute 14 concurrent searches when I only have the capability for 2x4=8 searches? What is the significance of base_max_search constant?

0 Karma
1 Solution

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

View solution in original post

hsesterhenn_spl
Splunk Employee
Splunk Employee

Hi,

we usually say that a search is using a cpu core when executed. This not 100% true because a search started on the search head is not using the CPU core 100% of the time. Each search will fork a process on the search head doing it's magic and so the scheduler of the operating system is trying to run as many processes in parallel as possible.
So, we do over commit a little bit to make sure we don't waste resources.

The base_max_searches is a value we calculated based on the results we have seen at our customers and during our own performance tests over the last couple of years.

Usually you don't need to change the values because it's "best practices".

Please file a support case and/or talk to our PS consultants if you think you have to change anything because the way your environment is working differs from the "average" customer 🙂

HTH,

Holger

ppuru
Path Finder

Holger,
I got your point. Thank you for shedding some light around the mystery.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...