Set limits for concurrent scheduled searches
When you run searches, Splunk limits the number of concurrent searches to preserve the performance for each search. In Splunk Cloud, this concurrent limit is configured for you. Note the following defaults:
- 50% of your concurrent searches are scheduled searches.
- 25% of your concurrent searches are summarization searches.
However, you may want to adjust the relative number of concurrent scheduled and summarization searches based on your organization's usage. For example:
- If you primarily run scheduled searches, this means you may want to enable most of your searches to be scheduled searches.
- If you use primarily data model acceleration searches, you may want to allocate a larger percentage of searches to summarization searches.
Splunk enables you to adjust limits for concurrent scheduled searches and summarization searches so that you can tailor the available concurrent searches to your organization's needs.
You must have the edit_search_concurrency_all and edit_search_concurrency_scheduled capabilities to configure these settings.
When you configure limits, be sure to first test your settings in a test environment to ensure they are optimal for your production environment. For example:
- If you set a limit of 70% of your searches to be scheduled searches, ad-hoc searches may run more slowly.
- If you set the limits for scheduled searches too low, certain scheduled searches may be skipped.
There are other concurrency settings which can impact your search resource allocation. For an overview of how searches are prioritized based on all configured concurrency settings, see Configure the priority of scheduled reports. The following sections describe scheduled and summarization searches and how you can modify their default values.
By default, the scheduled searches value is set to 50% in the Relative concurrency limits for scheduled searches field on the Search preferences page. These are the searches that you schedule using the Search Scheduler or that are created as a part of report acceleration or data model acceleration. Ad-hoc searches are not included in this group. For this limit, you set the value as a percentage of your total searches. Consider the following examples:
- You set the value to 70%. This means that out of available searches, at most scheduled searches (including user-scheduled and summarization searches) can use up to 70%.
- Your concurrent limit of 50% results in 19 scheduled searches and you change the settings to 75%. This results in the number of allowed concurrent scheduled searches changing to 27.
By default, the summarization searches value is set to 50% in the Relative concurrency limits for summarization searches field on the Search preferences page. These are searches that are generated for report acceleration or data model acceleration. For this limit, you set the value as a percentage of the searches allocated for scheduled searches. Consider the following example:
You set the value to 50%. This means that at most acceleration searches can use up to 50% of the searches allocated for scheduled searches. If you configure a scheduled search concurrency limit of 50%, this results in a limit of 18 concurrent searches. If you set the summarization searches limit to 50%, then the summarization searches are allocated roughly 25% of total searches or roughly 9 summarization searches.
Configure concurrent scheduled search limits
- In Splunk Web, click Settings > Server settings > Search Preferences.
- Specify an option for Default search time range.
- In Relative concurrency limits for scheduled searches, select a percentage value for the concurrency limit for scheduled searches. This includes user-scheduled searches and summarization searches.
- In Relative concurrency limits for summarization searches, select a percentage value for the concurrency limit for summarization searches. This value represents a percentage of the total allocated resources for scheduled searches.
- Click Save.
Configure hybrid search
Workload Management overview
This documentation applies to the following versions of Splunk Cloud™: 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105