A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
A.
Create a job server on the cluster.
B.
Add another search head to the cluster.
C.
server.conf captain_is_adhoc_searchhead = true.
D.
Change limits.conf value for max_searches_per_cpu to a higher value.
Could be Answer D.
Ref: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Reducing_skipped_searches#:~:text=The%20total%20maximum%20concurrency%20limit%20is%20too%20low
Could be also B
Ref:
https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements#:~:text=You%20can%20optionally%20add%20more%20members%20to%20boost%20search%20and%20user%20capacity.
D
Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_searches_per_cpu and related settings in limits.conf
https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/SHCjobscheduling
Jacking up the max_searches_per_cpu doesn't always solve the problem. There a limit to this strategy. Once you're out of cpu, its going to have large queue and skipped searches.
My answer would be B or ensure your scheduled reports are scheduled for exact same time.
Answer is C i guess.
The SHC is over-tasked with too many scheduled searches, resulting in a high skip ratio
https://aditumpartners.com/troubleshooting-splunk-search-head-clusters/
If you switch the captain_is_adhoc_searchhead to true, it will stop all the scheduled searches on the captain SH. So, D is better answer
upvoted 8 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
rodrigok
Highly Voted 2 years, 2 months agoBob_Hob
Most Recent 2 weeks agobobixaka
6 months, 3 weeks agobobixaka
6 months, 3 weeks agowillsy
1 year, 10 months agosamme
1 year, 9 months agosovip52250
1 year, 10 months agoSasnycoN
2 years, 7 months agosunil299
3 years, 6 months agoBianchi
2 years, 4 months agoNew_user
3 years, 5 months ago