Capacity planning for Splunk Industrial Asset Intelligence

Review the following guidelines before you make decisions about your deployment of Splunk Industrial Asset Intelligence (IAI).

Splunk platform capacity planning

All Splunk Enterprise capacity planning considerations apply to Splunk IAI. To properly scale your deployment with Splunk IAI, see Introduction to capacity planning for Splunk Enterprise in the Capacity Planning Manual.

Splunk IAI capacity planning

Work with Splunk Professional Services to plan the capacity for your Splunk IAI deployment.

In preparation for your Splunk IAI capacity planning, make sure you have the following information:

1. A list of asset hierarchies you plan to create.
2. An estimated number of raw metrics per asset you plan to ingest from your data sources.
3. An estimated number of calculated metrics, alerts, and monitor views you want to create.
4. The number of users who need to access Splunk IAI simultaneously.

Tune load settings based on planned capacity

The default settings in Splunk IAI are optimized for most deployments. You might want to tune the load settings in Splunk IAI if many of the following are true:

• Your deployment has a large number of users.
• Users frequently open a large number of uncached Monitor Views.
• Alerts run frequently.
• You have adjusted the limits in Splunk Enterprise and want to take advantage of those adjustments in Splunk IAI.

You must edit a configuration file to make these changes. If you have not edited a configuration file before, see How to edit a configuration file in the Splunk Enterprise Admin Manual.

Improperly modifying these settings can negatively affect the performance of your Splunk Enterprise instance.

1. Open the local version of the Splunk IAI limits.conf file for editing. If one does not exist, create it.
2. Locate the iai_spl_search_parameters stanza. If it does not exist, create it.
3. If your deployment has a large number of users or you increased the max_concurrent_searches setting in Splunk Enterprise, modify the max_concurrent_search_perc from the default of 60 to something higher, up to 100.
   Splunk IAI allocates the total number of concurrent searches available in Splunk Enterprise according to this percentage. If the max_concurrent_searches for the base_max_searches and max_searches_per_cpu stanzas in the limits.conf file for Splunk Enterprise is set to 10, the default of 60 for the max_concurrent_search_perc in Splunk IAI allocates 6 of those 10 searches to Splunk IAI.

   The percentage used for this setting must allow at least 6 searches to run in Splunk IAI.

4. If your deployment has a large number of users, you might want to increase the max_concurrent_threads setting from the default of 200 to something higher.

For more about max_concurrent_searches settings, see How concurrent users and searches impact performance in the Splunk Enterprise Capacity Planning Manual and limits.conf in the Splunk Enterprise Admin Manual.