The concurrency limit is set to five based on the below log.
We are using a 4 core CPU, and according to the limits.conf, shouldn't the limit be 10 concurrent searches(6+4*1)?
Base_max_searches = 6
cpu cores = 4
max_searches_per_cpu = 1
Can anyone explain why the concurrency limit is set as 5 and not 10.
01-29-2019 18:19:00.450 -0600 INFO SavedSplunker - savedsearch_id="nobody;search;JBoss7 OutOfMemory Alert", search_type="scheduled", user="329421", app="search", savedsearch_name="JBoss7 OutOfMemory Alert", priority=default, status=skipped, reason="The maximum number of concurrent historical scheduled searches on this instance has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_instance-wide", **concurrency_limit=5**, scheduled_time=1548807480, window_time=0
Because it's a scheduled search:
( from Splunk Answers: https://answers.splunk.com/answers/270544/how-to-calculate-splunk-search-concurrency-limit-f.html )
How Many scheduled searches can be run concurrently?
Attribute: 50% of max historical searches (max_searches_perc = 50)
5(max_hist_scheduled_searches) = 0.5(max_searches_perc / 100) x 10(max_hist_searches)