Splunk Enterprise service limits
The following are Splunk Enterprise service limits and constraints. These service limits are applicable to all Splunk Enterprise subscriptions. You can use this list as guidance to ensure the best experience. Keep in mind that some limits depend on configuration, system load, performance, and available resources.
| Service Limit | Best Practice |
|---|---|
| Number of primary buckets in the cluster | Max: 40,000,000
|
| Number of concurrent users | Max: 2000
|
| Number of peers in a non-clustered distributed search environment | Max: 1000 with bestEffortSearch
|
| Number of alert suppressions in a search head cluster | Max: 100,000
|
| Number of search-heads in a search head cluster | Max: 50
|
| Number of sites in multisite cluster | Max: 6
|
| Forwarder-to-indexer ratios | Parallelization settings |
This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2, 9.4.0
Download manual
Feedback submitted, thanks!