A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
To increase scheduled search capacity on the search head cluster, adding another search head to the cluster is the appropriate solution. This action distributes the search load across more nodes, increasing the overall search capacity and reducing the likelihood of skipped searches. Creating a job server or changing configuration values might help in specific cases but won't effectively address the root cause of inadequate search head capacity like adding more search heads would.
correct is B: cluster-admin -145
Should be D: https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/SHCjobscheduling
A three-node search head cluster is skipping a large
Could be Answer D. Ref: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Searching_and_Reporting/Reducing_skipped_searches#:~:text=The%20total%20maximum%20concurrency%20limit%20is%20too%20low
Could be also B Ref: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/SHCsystemrequirements#:~:text=You%20can%20optionally%20add%20more%20members%20to%20boost%20search%20and%20user%20capacity.
Answer is C i guess. The SHC is over-tasked with too many scheduled searches, resulting in a high skip ratio https://aditumpartners.com/troubleshooting-splunk-search-head-clusters/
If you switch the captain_is_adhoc_searchhead to true, it will stop all the scheduled searches on the captain SH. So, D is better answer
This,actually , will be worse
D Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_searches_per_cpu and related settings in limits.conf https://docs.splunk.com/Documentation/Splunk/8.2.4/DistSearch/SHCjobscheduling
Jacking up the max_searches_per_cpu doesn't always solve the problem. There a limit to this strategy. Once you're out of cpu, its going to have large queue and skipped searches. My answer would be B or ensure your scheduled reports are scheduled for exact same time.