Related Answers
Download topic as PDF
Splunk Enterprise service limits
The following are Splunk Enterprise service limits and constraints. These service limits are applicable to all Splunk Enterprise subscriptions. You can use this list as guidance to ensure the best experience. Keep in mind that some limits depend on configuration, system load, performance, and available resources.
| Service Limit | Best Practice |
|---|---|
| Number of buckets in the cluster | Max: 40,000,000
|
| Number of concurrent users | Max: 2000
|
| Number of peers in a non-clustered distributed search environment | Max: 1000 with bestEffortSearch
|
| Number of alert suppressions in a search head cluster | Max: 100,000
|
| Number of search-heads in a search head cluster | Max: 50
|
| Number of sites in multisite cluster | Max: 6
|
Last modified on 15 September, 2023
|
PREVIOUS Forwarder-to-indexer ratios |
NEXT Parallelization settings |
This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.1.0, 9.1.1
Feedback submitted, thanks!