How can I increase the max number of searches on my dashboard in Splunk Enterprise?

[kevinreese]

I'm running Splunk Enterprise on my Windows machine and am facing an issue in loading my dashboard fully. The dashboard contains 2 tables and 14 scatter plots. When I load the dashboard, 6 of the 16 searches give an error. The error message for those 6 is this:

In handler 'savedsearch': Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current=10 maximum=10 SearchId=admin__admin__search__RMD5b21c14aa536784c7_at_1452546718_91

limits.conf.spec defines max_hist_searches = max_searches_per_cpu x number_of_cpus(I have 4 on the machine) + base_max_searches
Therefore, in "C:-Program Files-Splunk-etc-system-local" I have manually added limits.conf with the following stanzas:

[search]
max_searches_per_cpu = 2
base_max_searches = 6

btool confirms that Splunk sees these values, but my dashboard is still limited to the first 10 searches. Should the changes that I made to limits.conf be sufficient, or is there another directory where I need to place these changes to limits.conf?

[gyslainlatsa · Accepted solution]

hi kevinreese,

The maximum number of searches is proportional of the number of cores on the system, so you could improve the hardware.
see http://docs.splunk.com/Documentation/Splunk/6.3.2/Capacity/Accommodatemanysimultaneoussearches

[kevinreese]

Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu on the stanza max_searches_per_cpu. If that is true then would the manual specification trump the actual number of cpus on the machine?,Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu. If that is true then would that trump the number of cpus on the machine?