https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75474#M19074 <P>Doesn't seem to work anymore.</P> Thu, 07 Jan 2016 16:10:35 GMT demodav 2016-01-07T16:10:35Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75469#M19069 <P>I am not searching anything why above message display very frequently?<BR /> While I have deleted all saved search.</P> Thu, 14 Jun 2012 14:01:54 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75469#M19069 jangid 2012-06-14T14:01:54Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75470#M19070 <P>Any Updates?</P> Mon, 18 Jun 2012 09:36:31 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75470#M19070 jangid 2012-06-18T09:36:31Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75471#M19071 <P>Some of real time search will be run whenever you view the top of the search App. And I guess some saved search still remains so that you wee the warning.</P> Mon, 18 Jun 2012 10:56:58 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75471#M19071 Takajian 2012-06-18T10:56:58Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75472#M19072 <P>Is there any parameter to configure anywhere in Splunk in order to fix this problem or stop showing this message?</P> Fri, 14 Sep 2012 12:13:42 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75472#M19072 wagnerbianchi 2012-09-14T12:13:42Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75473#M19073 <P>This is ok now. the procedures to fix that are below...</P> <P>$ sudo touch $SPLUNK_HOME/etc/system/local/limits.conf<BR /> $ sudo vim $SPLUNK_HOME/etc/system/local/limits.conf</P> <P>[search]<BR /> base_max_searches=100<BR /> max_searches_per_cpu=10</P> <P>$ sudo $SPLUNK_HOME/bin/splunk restart</P> <P>Stopping splunkweb...<BR /> Stopping splunkd...<BR /> Shutting down. Please wait, as this may take a few minutes.</P> <P>Stopping splunk helpers...</P> <P>Done.</P> <P>Splunk&gt; Take the sh out of IT.</P> <P>Checking prerequisites...<BR /> Checking http port [8000]: open<BR /> Checking mgmt port [8089]: open<BR /> Checking configuration... Done.<BR /> Checking index directory...<BR /> Validated databases: _audit _blocksignature _internal _thefishbucket appmgmt blackberry history main msexchange perfmon sos sos_summary_daily summary summary_forwarders summary_hosts summary_indexers summary_pools summary_sources summary_sourcetypes<BR /> Done<BR /> Success<BR /> Checking conf files for typos...<BR /> All preliminary checks passed.</P> <P>Starting splunk server daemon (splunkd)... <BR /> Done.<BR /> Starting splunkweb... Done.</P> <P>If you get stuck, we're here to help.<BR /><BR /> Look for answers here: <A href="http://docs.splunk.com/Documentation/Splunk" target="_blank">http://docs.splunk.com/Documentation/Splunk</A></P> <P>The Splunk web interface is at <A href="http://myhost:8000" target="_blank">http://myhost:8000</A></P> <P>Cheers!</P> Mon, 28 Sep 2020 12:26:28 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75473#M19073 wagnerbianchi 2020-09-28T12:26:28Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75474#M19074 <P>Doesn't seem to work anymore.</P> Thu, 07 Jan 2016 16:10:35 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75474#M19074 demodav 2016-01-07T16:10:35Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75475#M19075 <P>does this error affect anything or can it be easily ignored?</P> Mon, 16 May 2016 20:23:07 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75475#M19075 mtime24 2016-05-16T20:23:07Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75476#M19076 <P>Thank you, Sir! Worked like a charm. Now to make sure I don't overload my server with too many real-time alerts <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 27 Jan 2017 21:16:47 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75476#M19076 BrendanCO 2017-01-27T21:16:47Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75477#M19077 <P>This is more than a little dated, and the way these configurations work has changed in 5 years. <BR /> Do NOT use these settings in limits.conf<BR /> The error message will go away, but plenty of new pain will result.</P> Thu, 07 Dec 2017 00:50:31 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75477#M19077 ehorton_splunk 2017-12-07T00:50:31Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75478#M19078 <P>more current answer is here:<BR /> <A href="https://answers.splunk.com/answers/607068/the-maximum-number-of-concurrent-historical-search.html">https://answers.splunk.com/answers/607068/the-maximum-number-of-concurrent-historical-search.html</A><BR /> I beleive it simply comes down to how many searches you're running vs how many cpu's you have.<BR /> If you bother to change limits.conf just to remove the message it won't change the fact that you're limited by the number of cpus.</P> Mon, 01 Jul 2019 16:29:34 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75478#M19078 dbroggy 2019-07-01T16:29:34Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75479#M19079 <P>I downvoted this post because this is very dated information, and no longer valid and may result in a seriously broken environment. please do not set settings this high without consultation.</P> Wed, 18 Sep 2019 19:31:07 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75479#M19079 jsie_splunk 2019-09-18T19:31:07Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75480#M19080 <P>I downvoted this post because this answer will quite likely bury the indexers and/or crash the search heads. simply put, it is technically incorrect.</P> Wed, 18 Sep 2019 19:33:49 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75480#M19080 nmiller_splunk 2019-09-18T19:33:49Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75481#M19081 <P>I downvoted this post because things</P> Wed, 18 Sep 2019 20:43:52 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75481#M19081 mbuehler_splunk 2019-09-18T20:43:52Z https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75482#M19082 <P>I downvoted this post because things</P> Wed, 18 Sep 2019 20:43:54 GMT https://community.splunk.com/t5/Splunk-Search/The-system-is-approaching-the-maximum-number-of-historical/m-p/75482#M19082 mbuehler_splunk 2019-09-18T20:43:54Z