Splunk Cloud

Splunk Cloud User Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Set limits for concurrent scheduled searches

When you run searches, Splunk limits the number of concurrent searches (searches that are running at the same time) in order to preserve the performance for each search. In Splunk Cloud, this concurrent limit is configured for you. By default, 50% of your searches are scheduled searches and summarization searches are allocated 25% of searches. However, you may want to adjust the relative number of concurrent scheduled and summarization searches based on your usage. For example, your organization may primarily run scheduled searches, which means you may want to enable most of your searches to be scheduled searches. Or, if you use primarily data model acceleration searches, you may want to allocate a larger percentage of searches to summarization searches. Splunk enables you to adjust limits for concurrent scheduled searches and summarization searches so that you can tailor the available concurrent searches to your organization's needs.

You must have the edit_search_concurrency_all and edit_search_concurrency_scheduled capabilities to configure these settings.


Any time you configure limits, there are trade-offs, and you will need to test your settings to ensure they are optimal for your environment. For example, if you set a limit of 70% of your searches to be scheduled searches, then you may run your ad-hoc searches more slowly. Or, if you set the limits for scheduled searches too low, you may skip scheduled searches. To ensure you have configured the settings correctly, test them in a non-production environment as a best practice.

There are other concurrency settings which can impact your search resource allocation, and it's a good idea to understand how searches are prioritized based on all configured concurrency settings. For an overview of concurrency settings, see Configure the priority of scheduled reports.

You can modify the following limits:

  • Scheduled searches. By default, this value is set to 50%. These are the searches that you schedule using the Search Scheduler or that are created as a part of report acceleration or data model acceleration. Ad-hoc searches are not included in this group. For this limit, you set the value as a percentage of your total searches. For example, you may want to set the value to 70%. This means that out of available searches, at most scheduled searches (including user-scheduled and summarization searches) can use up to 70%. For example, if your concurrent limit of 50% results in 19 scheduled searches, and you change the settings to 75%, the number of allowed concurrent scheduled searches changes to 27.
  • Summarization searches. By default, this value is set to 50%. These are searches that are generated for report acceleration or data model acceleration. For this limit, you set the value as a percentage of the searches allocated for scheduled searches. For example, if you set the value to 50%, this means that at most acceleration searches can use up to 50% of the searches allocated for scheduled searches. For example, if you configure a scheduled search concurrency limit of 50%, and this results in a limit of 18 concurrent searches, and you set the summarization searches limit to 50%, then the summarization searches are allocated roughly 25% of total searches or roughly 9 summarization searches.

Configure concurrent scheduled search limits

  1. In Splunk Web, click Settings > Server settings > Search Preferences.
  2. In the Relative concurrency limits for scheduled searches select a percentage value for the concurrency limit for scheduled searches. This includes user-scheduled searches and summarization searches.
  3. In the Relative concurrency limits for summarization searches select a percentage value for the concurrency limit for summarization searches. This value represents a percentage of the total allocated resources for scheduled searches.
  4. Click Save.

The graphic shows a screenshot of the concurrent limits screen for orientation purposes.

Last modified on 10 April, 2020
PREVIOUS
Manage Splunk Cloud indexes
  NEXT
Configure SAML single sign-on (SSO) to Splunk Cloud

This documentation applies to the following versions of Splunk Cloud: 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters