When you run searches, Splunk limits the number of concurrent searches to preserve the performance for each search. In Splunk Cloud Platform, this concurrent limit is configured for you. Note the following defaults:
- 50% of your concurrent searches are scheduled searches.
- 25% of your concurrent searches are summarization searches.
You can adjust the relative number of concurrent scheduled and summarization searches to meet the needs of your organization. For example:
- If you primarily run scheduled searches, consider making most of your searches scheduled searches.
- If you use primarily data model acceleration searches, consider allocating a larger percentage of searches to summarization searches.
You can adjust limits for concurrent scheduled searches and summarization searches in Splunk Web using the Settings > Server settings > Search preferences page. Before adjusting these concurrency limits, note the following:
- You must have the edit_search_concurrency_scheduled capabilities to configure these settings.
- If your Splunk Cloud Platform deployment is on the Victoria Experience, you can configure concurrency limits for both search heads and search head clusters.
- If your Splunk Cloud Platform deployment is on the Classic Experience and a search head cluster, you must click Show All Settings for server settings to be available. Concurrency limits are replicated between search head cluster members.
For more information about the Experience designations, see Determine your Splunk Cloud Platform Experience.
When you configure limits, be sure to first test your settings in a test environment to ensure they are optimal for your production environment. For example:
- If you set a limit of 70% of your searches to be scheduled searches, ad-hoc searches may run more slowly.
- If you set the limits for scheduled searches too low, certain scheduled searches may be skipped.
There are other concurrency settings which can impact your search resource allocation. For an overview of how searches are prioritized based on all configured concurrency settings, see Configure the priority of scheduled reports.The following sections describe scheduled and summarization searches and how you can modify their default values.
Scheduled searches
By default, the scheduled searches value is set to 50% in the Relative concurrency limits for scheduled searches field on the Search preferences page. These are the searches that you schedule using the Search Scheduler or that are created as a part of report acceleration or data model acceleration. Ad-hoc searches are not included in this group. For this limit, you set the value as a percentage of your total searches. Consider the following examples:
- You set the value to 70%. This means that out of available searches, at most scheduled searches (including user-scheduled and summarization searches) can use up to 70%.
- Your concurrent limit of 50% results in 19 scheduled searches and you change the settings to 75%. This results in the number of allowed concurrent scheduled searches changing to 27.
Summarization searches
By default, the summarization searches value is set to 50% in the Relative concurrency limits for summarization searches field on the Search preferences page. These are searches that are generated for report acceleration or data model acceleration. For this limit, you set the value as a percentage of the searches allocated for scheduled searches. Consider the following example:
You set the value to 50%. This means that at most acceleration searches can use up to 50% of the searches allocated for scheduled searches. If you configure a scheduled search concurrency limit of 50%, this results in a limit of 18 concurrent searches. If you set the summarization searches limit to 50%, then the summarization searches are allocated roughly 25% of total searches or roughly 9 summarization searches.
Configure concurrent scheduled search limits
- In Splunk Web, click Settings > Server settings > Search preferences.
- Specify an option for Default search time range.
- In Relative concurrency limits for scheduled searches, select a percentage value for the concurrency limit for scheduled searches. This includes user-scheduled searches and summarization searches.
- In Relative concurrency limits for summarization searches, select a percentage value for the concurrency limit for summarization searches. This value represents a percentage of the total allocated resources for scheduled searches.
- Click Save.
Any changes that you make to the Default search time range, Relative concurrency limits for scheduled searches, and Relative concurrency limits for summarization searches values won't trigger a restart after you click Save.
