Search head pooling concurrency limits: missing per-role cap

Splunk Enterprise’s search head pooling distributes user queries across multiple search heads. The default configuration applies per-user and per-app limits via limits.conf but does not enforce a consistent cap at the role level when the pool is saturated.

When many concurrent searches are submitted, the pool may queue jobs even if individual search heads have free capacity. This manifests as latency spikes that are not apparent under isolated load. The unresolved decision is whether to enforce a global per-role limit, a per-pool limit, or rely solely on per-user settings.

What impact does enabling max_searches_per_user have on latency when search head pooling is active?

How does the pool’s max_searches_per_app setting interact with role-based limits during peak concurrency?

Should a per-role cap be introduced to prevent one role from monopolizing pooled search head resources?