Splunk Search

How to resolve "approaching the maximum number of historical searches" message received after moving to search head cluster?

sbattista09
Contributor

heyyyy everyone, anyone run into this annoying message before?

we keep getting this after moving to a search head cluster

"The system is approaching the
maximum number of historical searches
that can be run concurrently.
current=blahhh maximum=blahhahhh"

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@sbattista09 - Were you able to find a solution to your question? If yes, was it somesoni2's link or GregMefford's answer? If no solution was found still, please feel free to leave a comment with more information.

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

GregMefford
Explorer

The current number should be pretty straightforward to determine whether it's reasonable or not. The maximum is normally determined roughly by the number of cores on the search head unless you have changed you parallelization settings ( batch_search_max_pipeline setting in limits.conf).

http://docs.splunk.com/Documentation/Splunk/6.5.0/Capacity/Parallelization

Maybe your SHC has less cores per server than your previously stand-alone Search Head?
You can also look in the Distribute Management Center to see the number of concurrent historical searches over time.

For example, if you open a dashboard with a dozen panels that are each running an independent search, that counts as 12.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...