Capacity planning for Splunk Industrial Asset Intelligence
Review the following guidelines before you make decisions about your deployment of Splunk Industrial Asset Intelligence (IAI).
Splunk platform capacity planning
All Splunk Enterprise capacity planning considerations apply to Splunk IAI. To properly scale your deployment with Splunk IAI, see Introduction to capacity planning for Splunk Enterprise in the Capacity Planning Manual.
Splunk IAI capacity planning
Work with Splunk Professional Services to plan the capacity for your Splunk IAI deployment.
In preparation for your Splunk IAI capacity planning, make sure you have the following information:
- A list of asset hierarchies you plan to create.
- An estimated number of raw metrics per asset you plan to ingest from your data sources.
- An estimated number of calculated metrics, alerts, and monitor views you want to create.
- The number of users who need to access Splunk IAI simultaneously.
Tune load settings based on planned capacity
The default settings in Splunk IAI are optimized for most deployments. You might want to tune the load settings in Splunk IAI if many of the following are true:
- Your deployment has a large number of users.
- Users frequently open a large number of uncached Monitor Views.
- Alerts run frequently.
- You have adjusted the limits in Splunk Enterprise and want to take advantage of those adjustments in Splunk IAI.
You must edit a configuration file to make these changes. If you have not edited a configuration file before, see How to edit a configuration file in the Splunk Enterprise Admin Manual.
Improperly modifying these settings can negatively affect the performance of your Splunk Enterprise instance.
- Open the local version of the Splunk IAI
limits.conffile for editing. If one does not exist, create it.
- Locate the
iai_spl_search_parametersstanza. If it does not exist, create it.
- If your deployment has a large number of users or you increased the
max_concurrent_searchessetting in Splunk Enterprise, modify the
max_concurrent_search_percfrom the default of 60 to something higher, up to 100.
Splunk IAI allocates the total number of concurrent searches available in Splunk Enterprise according to this percentage. If the
max_searches_per_cpustanzas in the
limits.conffile for Splunk Enterprise is set to 10, the default of 60 for the
max_concurrent_search_percin Splunk IAI allocates 6 of those 10 searches to Splunk IAI.
The percentage used for this setting must allow at least 6 searches to run in Splunk IAI.
- If your deployment has a large number of users, you might want to increase the
max_concurrent_threadssetting from the default of 200 to something higher.
For more about
max_concurrent_searches settings, see How concurrent users and searches impact performance in the Splunk Enterprise Capacity Planning Manual and limits.conf in the Splunk Enterprise Admin Manual.
Deployment planning for Splunk Industrial Asset Intelligence
Requirements for Splunk Industrial Asset Intelligence
This documentation applies to the following versions of Splunk® Industrial Asset Intelligence (Legacy): 1.2.1, 1.2.2, 1.3.0
Feedback submitted, thanks!