Every once in a while, we will get this message, and I understand it.
I would like to run a periodic search, add it to a summary index, and chart against it so that I can see when it happens historically.
I have read through some of the answers here, but I am wondering if there is just a Splunk search that will spit out the number of concurrent searches happening at that time. Does that exist? Since the error shows a number, I am assuming it is possible?