A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
A.
Create a job server on the cluster.
B.
Add another search head to the cluster.
C.
server.conf captain_is_adhoc_searchhead = true.
D.
Change limits.conf value for max_searches_per_cpu to a higher value.
Could be Answer D.
Ref: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Reducing_skipped_searches#:~:text=The%20total%20maximum%20concurrency%20limit%20is%20too%20low
Could be also B
Ref:
https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements#:~:text=You%20can%20optionally%20add%20more%20members%20to%20boost%20search%20and%20user%20capacity.
D
Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_searches_per_cpu and related settings in limits.conf
https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/SHCjobscheduling
Jacking up the max_searches_per_cpu doesn't always solve the problem. There a limit to this strategy. Once you're out of cpu, its going to have large queue and skipped searches.
My answer would be B or ensure your scheduled reports are scheduled for exact same time.
Answer is C i guess.
The SHC is over-tasked with too many scheduled searches, resulting in a high skip ratio
https://aditumpartners.com/troubleshooting-splunk-search-head-clusters/
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
rodrigok
Highly Voted 2 years, 4 months agoBob_Hob
Most Recent 2 months agobobixaka
8 months, 1 week agobobixaka
8 months, 1 week agowillsy
1 year, 11 months agosamme
1 year, 10 months agosovip52250
2 years agoSasnycoN
2 years, 8 months agosunil299
3 years, 8 months agoBianchi
2 years, 5 months agoNew_user
3 years, 7 months ago