Splunk Search

How can I increase the max number of searches on my dashboard in Splunk Enterprise?

kevinreese
Engager

I'm running Splunk Enterprise on my Windows machine and am facing an issue in loading my dashboard fully. The dashboard contains 2 tables and 14 scatter plots. When I load the dashboard, 6 of the 16 searches give an error. The error message for those 6 is this:

In handler 'savedsearch': Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current=10 maximum=10 SearchId=admin__admin__search__RMD5b21c14aa536784c7_at_1452546718_91

limits.conf.spec defines max_hist_searches = max_searches_per_cpu x number_of_cpus(I have 4 on the machine) + base_max_searches
Therefore, in "C:-Program Files-Splunk-etc-system-local" I have manually added limits.conf with the following stanzas:

[search]
max_searches_per_cpu = 2
base_max_searches = 6

btool confirms that Splunk sees these values, but my dashboard is still limited to the first 10 searches. Should the changes that I made to limits.conf be sufficient, or is there another directory where I need to place these changes to limits.conf?

0 Karma
1 Solution

gyslainlatsa
Motivator

hi kevinreese,

The maximum number of searches is proportional of the number of cores on the system, so you could improve the hardware.
see http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Accommodatemanysimultaneoussearches

View solution in original post

0 Karma

gyslainlatsa
Motivator

hi kevinreese,

The maximum number of searches is proportional of the number of cores on the system, so you could improve the hardware.
see http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Accommodatemanysimultaneoussearches

0 Karma

kevinreese
Engager

Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu on the stanza max_searches_per_cpu. If that is true then would the manual specification trump the actual number of cpus on the machine?,Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu. If that is true then would that trump the number of cpus on the machine?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...