Deployment Architecture

Skipped scheduler searches :Your maximum number of concurrent searches has been reached. usage=3104 quota=3000 user=admin.

ankithnageshshe
Path Finder

Hello All,

Lately I see a lot of skipped scheduler searches in my search head cluster (3) with the reason "Your maximum number of concurrent searches has been reached. usage=3104 quota=3000 user=admin".

If I view from DMC console, I see not more than 200 searches run for each search head summing up to almost 600~700 searches for admin user in the last 4 hours.

I do not see any active running searches neither in the search head job manager nor on the Scheduler activity in the DMC.
However I see a lot of deferred jobs for one of the search head in DMC console.

Do you think rolling restart of search heads will help here as I do not see any search related issue here.

Regards,
Ankith

Tags (1)
0 Karma
1 Solution

ankithnageshshe
Path Finder

Hi All,

Rolling restart of the SHC fixed the issue. Brought down the deferred jobs from 90K to 2K after the rolling restart.

But I'am trying to understand the difference between concurrency search quota for user( admin) and the historical system wide search quota. How this will impact my SHC performance?

Regards,
Ankith

View solution in original post

0 Karma

ankithnageshshe
Path Finder

Hi All,

Rolling restart of the SHC fixed the issue. Brought down the deferred jobs from 90K to 2K after the rolling restart.

But I'am trying to understand the difference between concurrency search quota for user( admin) and the historical system wide search quota. How this will impact my SHC performance?

Regards,
Ankith

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...