Set limits for concurrent scheduled searches
When you run searches, Splunk limits the number of concurrent searches (searches that are running at the same time) in order to preserve the performance for each search. In Splunk Cloud, this concurrent limit is configured for you. By default, scheduled searches are allocated a limit of 50% of search resources, and summarization searches are allocated a limit of 25% of search resources. However, you may want to adjust the relative number of concurrent scheduled and summarization searches based on your usage. For example, your organization may primarily run scheduled searches, which means you may want to use most of your search resources for scheduled searches. Or, if you use primarily data model acceleration searches, you may want to allocate a larger percentage of searches to summarization searches. Splunk enables you to set limits for concurrent scheduled searches and summarization searches so that you can tailor resource usage to your organization's needs.
You must have the edit_search_concurrency_all and edit_search_concurrency_scheduled capabilities to configure these settings.
Any time you configure limits, there are trade-offs, and you will need to test your settings to ensure they are optimal for your environment. For example, if you set a limit of 70% of your search resources for scheduled searches, then you may run your ad-hoc searches more slowly. Or, if you set the limits for scheduled searches too low, you may skip scheduled searches. To ensure you have configured the settings correctly, test them in a non-production environment as a best practice.
There are other concurrency settings which can impact your search resource allocation, and it's a good idea to understand how searches are prioritized based on all configured concurrency settings. For an overview of concurrency settings, see Configure the priority of scheduled reports.
You can modify the following limits:
- Scheduled searches. By default, this value is set to 50%. These are the searches that you schedule using the Search Scheduler or that are created as a part of report acceleration or data model acceleration. Ad-hoc searches are not included in this group. For this limit, you set the value as a percentage of your total searches. For example, you may want to set the value to 70%. This means that out of resources allocated for searches, at most scheduled searches (including user-scheduled and summarization searches) can use up to 70% of your resources. For example, if your concurrent limit of 50% results in 19 scheduled searches, and you change the settings to 75%, the number of allowed concurrent scheduled searches changes to 27.
- Summarization searches. By default, this value is set to 50%. These are searches that are generated for report acceleration or data model acceleration. For this limit, you set the value as a percentage of the resources allocated for scheduled searches. For example, if you set the value to 50%, this means that at most acceleration searches can use up to 50% of the resources allocated for scheduled searches. For example, if you configure a scheduled search concurrency limit of 50%, and this results in a limit of 18 concurrent searches, and you set the summarization searches limit to 50%, then the summarization searches are allocated roughly 25% of total search resources or roughly 9 summarization searches.
If you use workload management to manage search resources, note that these settings will impact each other. For an explanation of these interactions, see Search concurrency considerations in workload management.
Configure concurrent scheduled search limits
- In Splunk Web, click Settings > Server settings > Search Preferences.
- In the Relative concurrency limits for scheduled searches select a percentage value for the concurrency limit for scheduled searches. This includes user-scheduled searches and summarization searches.
- In the Relative concurrency limits for summarization searches select a percentage value for the concurrency limit for summarization searches. This value represents a percentage of the total allocated resources for scheduled searches.
- Click Save.
Archive expired Splunk Cloud data
Manage Splunk Cloud users and roles
This documentation applies to the following versions of Splunk Cloud™: 8.0.0