Security business menu
Security business
HOME
To be elected
cause
Service
Handling Manufacturer
Examples/reports/
Blog/Glossary
Seminar/
video on demand
TOP
Products/Services
Specifications/Technical Information
solution
User stories
support
Seminar content
Evaluation machine application/FAQ
Document request
inquiry
Event/Seminar
video on demand

How to limit concurrent search executions by user or role

release date
2018-06-18
last updated
2024-01-11
version
Splunk Enterprise 9.0.3
Overview
Limit concurrent search runs per user or role
Reference information
content

In Splunk settings, it is possible to limit the maximum number of concurrent search jobs and concurrent real-time searches for each user, as well as the maximum number of concurrent search jobs and total concurrent real-time searches for each role.

Setting method

  • Log in to Splunk Web as a user with admin privileges, go to "Settings" > "Roles", click the role name you want to configure, and change the following values in the "5. Resources" tab.
  • Role-level concurrent search job limit
  • Role-level concurrent real-time search job limit
  • User-level concurrent search job limit
  • User-level concurrent real-time search job limit
  • Add the following to the configuration file to enable role-level job limit settings:
$SPLUNK_HOME/etc/system/local/limits.conf

[search]enable_cumulative_quota = true

*$SPLUNK_HOME is the installation directory. By default, it is as follows:
Linux: /opt/splunk
Windows: C:\Program Files\Splunk

  • Restart the Splunk service to reflect the settings in 2 above.

that's all

to previous page