Running Splunk 6.5.2 build 67571ef4b87d.
4 searches saved as alerts to send emails when triggered by certain content in an event.
Keep getting errors in the scheduler log and emails are suppressed:
07-12-2017 19:26:11.265 +0200 INFO SavedSplunker - savedsearch_id="nobody;search;Pre-Trade Multi-Account-Alloc", search_type="scheduled", user="paschilke", app="search", savedsearch_name="Pre-Trade Multi-Account-Alloc", priority=default, status=skipped, reason="The maximum number of concurrent running jobs for this real-time scheduled search on this instance has been reached", concurrency_category="real-time_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=1, scheduled_time=1499880360, window_time=0
Scanned through the forums and as it looks this is due to a limitation on how many realtime searches can run on the available CPUs.
Have adjusted max_searches_per_cpu and max_rt_search_multiplier according to the documentation but this did not help.
Could not find any information on which role the user has will win in regards to "User-level concurrent search jobs limit", the more restrictive one or the less restrictive one?
Where else can I look?
Any help really appreciated.
