Hard limit for “Event Analytics / Notable Event Aggregation Policies” is 100

Applicability

Description

Clarification Regarding the Hard Limit for ITSI Notable Event Aggregation Policies for organizations that have more the 100 NEAP configured.

Resolution

The 100 NEAP value is the published Splunk Cloud Platform service limit for the number of configured policies, not a concurrency limit. The Service Details page further describes this as a 50/50 split between time-based and non-time-based NEAPs. It does not say that disabled policies are excluded, so the conservative interpretation is 100 total configured NEAPs.

The reason you can have N-number(above 100) configured / N-number(above 100) enabled in enabled state is that the current ITSI application does not enforce the limit when a policy is created or enabled. The Rules Engine retrieves and instantiates all non-disabled policies; there is no code path that stops at policy 100. In other words, this is a service-limit/documentation guardrail, not a runtime concurrency cap in the current implementation. The observed count therefore exposes a documentation-versus-enforcement gap; it should not be taken to mean that 548 policies is supported scale.

The likely impact is workload-dependent Rules Engine pressure: more policy evaluations, memory/state, episode creation, and additional cost from time-based criteria and action rules. There is no defined failure that occurs specifically at policy 101, so the absence of errors today does not establish that the configuration is safe. Splunk may also ask that the deployment be brought within published limits when investigating related performance or stability issues.

Yes, Splunk recommend that you rationalize and reduce the enabled policies on your stack, first removing obsolete/duplicate policies and consolidating overlapping use cases. The immediate target should be compliance with the Cloud service limit (100 total, respecting the documented split).

For best performance, ITSI's more conservative implementation guidance recommends no more than 20 time-based plus 20 non-time-based enabled policies, so policy complexity and alert volume should also be reviewed rather than treating 100 as an optimal target.

References:
- Splunk Cloud Platform Service Details (https://help.splunk.com/en/splunk-cloud-platform/get-started/service-terms-and-policies/10.5.2605/information-about-the-service/splunk-cloud-platform-service-details)

- Best practices for implementing Event Analytics in ITSI (https://help.splunk.com/en/splunk-it-service-intelligence/splunk-it-service-intelligence/detect-and-act-on-notable-events/4.19/best-practices-and-troubleshooting/best-practices-for-implementing-event-analytics-in-itsi)