Deployment Architecture

Are there performance issues for increasing the "max_searches_per_CPU" setting in limits.conf to accommodate more historical concurrent searches?

ankithreddy777
Contributor

I have 16 core CPU on search head which accommodate 22 concurrent searches by default. When 22 concurrent searches is reached, it shows limit has been reached, but the CPU utilization is only 20 percent.

Can we increase the max_searches_per_CPU=2 or 3 in order to accommodate more historical concurrent searches. Does this have any performance issues?

Why does Splunk have default value=1?

0 Karma

eagle4splunk
Explorer

If your system can handle the load, you can increase your max_searches_per_cpu. I had an old instance where we had it at 6 on search heads with 12 core CPUs.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...