"maximum number of concurrent searches has been reached"

[lksridhar]

Folks,

I would like to get clarification to change the limit.conf file for "maximum number of concurrent searches has been reached". the user getting the error ""maximum number of concurrent searches has been reached" while accessing the dashboard ,

do we need to change the max_hist_searches in limit.conf on search head level or indexer level. i am not sure where need to change these to avoid the error. Could you please any one tell me where i need to do these changes.

Thanks,
Sridhar

[lksridhar]

Thanks for replaying, I understand the error and would like to know where do i need to configure the limits.conf whether in indexer or search head.?

[rjthibod]

You should respond to my answer with the "Add Comment" link directly under my answer, instead of commenting with a new answer.

To your question, if you think you already know what this is happening, then the places to edit are here in limits.conf are spelled out in the link I shared.

base_max_searches = <int>
 * A constant to add to the maximum number of searches, computed as a multiplier
   of the CPUs.
 * Defaults to 6

 max_searches_per_cpu = <int>
 * The maximum number of concurrent historical searches per CPU. The system-wide
   limit of historical searches is computed as:
   max_hist_searches =  max_searches_per_cpu x number_of_cpus + base_max_searches
 * Note: the maximum number of real-time searches is computed as:
   max_rt_searches = max_rt_search_multiplier x max_hist_searches
 * Defaults to 1

[lksridhar]

i understand the your answer but my question is, where is need to change the limits.conf file whether on search head or indexer side.

[aecruzp]

The change must be in the search head side, because this execute the querys and indexers only must be do data indexation funtions in a distribuited architecture.

[rjthibod · Accepted solution]

You should start with this answer: https://answers.splunk.com/answers/4888/getting-error-maximum-number-of-concurrent-searches-has-been...

Also, the problem could be bad dashboard design. You should make sure you are properly using base searches / global searches or accelerated search objects (accelerated reports, summary indexes, accelerated datamodels, etc.) wherever possible. You will need to share more details about your dashboard If you need help with these things.

Here is an example about base searches and post-processing: https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html