https://community.splunk.com/t5/Monitoring-Splunk/Monitor-Concurrent-Searches/m-p/254705#M8073 <P>Try something like this</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | timechart max(active_hist_searches) as "Historical Searches" min(active_realtime_searches) as "Real-time Searches" by host </CODE></PRE> Fri, 18 Mar 2016 20:57:53 GMT somesoni2 2016-03-18T20:57:53Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-Concurrent-Searches/m-p/254704#M8072 <P>Every once in a while, we will get this message, and I understand it. </P> <P>I would like to run a periodic search, add it to a summary index, and chart against it so that I can see when it happens historically. </P> <P>I have read through some of the answers here, but I am wondering if there is just a Splunk search that will spit out the number of concurrent searches happening at that time. Does that exist? Since the error shows a number, I am assuming it is possible?</P> <P>Thanks!</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1154iF130658126C27845/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 18 Mar 2016 16:36:42 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-Concurrent-Searches/m-p/254704#M8072 aferone 2016-03-18T16:36:42Z https://community.splunk.com/t5/Monitoring-Splunk/Monitor-Concurrent-Searches/m-p/254705#M8073 <P>Try something like this</P> <PRE><CODE>index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | timechart max(active_hist_searches) as "Historical Searches" min(active_realtime_searches) as "Real-time Searches" by host </CODE></PRE> Fri, 18 Mar 2016 20:57:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/Monitor-Concurrent-Searches/m-p/254705#M8073 somesoni2 2016-03-18T20:57:53Z