This is very confusing to me
Who can help me
Thanks a lot
Incidentally ,I monitor about 70 devices
Use splunk enterprise version:8.0.1
network toolkit version:1.4.3
Operating system : Ubuntu 18.0.4
I am changing parameters in SPLUNK_HOME /etc/system/local/limits.conf
# The base number of concurrent searches.
base_max_searches = 30
# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 30
# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 30
you have to debug your search opening it in Search Dashboard.
The approach is to delete a slice of your search from the end to the last pipe and watching results, if you have something, analyze them, if you haven't delete another slice of search until the previous pipe.
At first sight, I think that you should try to enlarge the time period because 30 seconds are very few and you couldn't have events.
then check the string "dest=192.168.x.x", because it's used by Splunk as a string and not as a field (it's between brackets!) and try using star instead x.
At least, see in the search results if the packet_loss field (that you use in the chart command) is present in your results, if not this is the problem.