Splunk Search

What is the maximum number of real-time searches that can be running?

mmilano
Explorer

I have about 50 real-time searches setup, but when I look at the running jobs, I don't see all of them. Can someone please tell me why?

Tags (1)
0 Karma

mmilano
Explorer

Thank you!! I increased max_rt_search_multiplier to 8.

mmilano
Explorer

I am running on a 12 core server.

0 Karma

yannK
Splunk Employee
Splunk Employee

As long as your server can keep up,
4 per core is the recommended, above is for over clockers 🙂

0 Karma

yannK
Splunk Employee
Splunk Employee

Default system limit is defined in limits.conf as Nb_core*4

User limits is defined per role is authorize.conf

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...