Splunk Enterprise service limits
The following are Splunk Enterprise service limits and constraints. These service limits are applicable to all Splunk Enterprise subscriptions. You can use this list as guidance to ensure the best experience. Keep in mind that some limits depend on configuration, system load, performance, and available resources.
| Service Limit | Best Practice |
|---|---|
| Number of primary buckets in the cluster | Max: 40,000,000 Recommended: 25,000,000 |
| Number of concurrent users | Max: 2000 Recommended: 500 |
| Number of peers in a non-clustered distributed search environment | Max: 1000 with bestEffortSearch Recommended: 500 |
| Number of alert suppressions in a search head cluster | Max: 100,000 Recommended: 1000 |
| Number of search-heads in a search head cluster | Max: 50 Recommended: 10 |
| Number of sites in multisite cluster | Max: 6 Recommended: 3 |