Deployment Architecture

concurrent search limit in distributed search

haobin
Explorer

There is a default limit for concurrent search which comes from max_searches_per_cpu x cpu_cores + base_max_searches. That is pretty clear for single node. However, I am coufused about this limit when running distributed searches.

Let's say we have 2 search heads and 4 indexers and the data are separated in 4 indexers averagely. And, each node can have 36 concurrent searches on each node according to the formula above. If I have 60 different and expensive searches running on 2 search heads, 30 for each, at the same time, excluding other limits, what will happen? Will all of them be run?

To simplify my question, does the concurrent search limit apply to all search heads and indexers when running distributed searches? Or just apply to search heads only?

Thanks.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

The concurrency limit applies independently at each search head only. This means that any individual indexer could have as many concurrent jobs as the product of the per-search head limit and the number of search heads. However, this is unlikely to be a problem in most deployments since the load factor on each indexer is less than one per search.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...