I'm running Splunk Enterprise on my Windows machine and am facing an issue in loading my dashboard fully. The dashboard contains 2 tables and 14 scatter plots. When I load the dashboard, 6 of the 16 searches give an error. The error message for those 6 is this:
In handler 'savedsearch': Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current=10 maximum=10 SearchId=admin__admin__search__RMD5b21c14aa536784c7_at_1452546718_91
limits.conf.spec defines maxhistsearches = maxsearchespercpu x numberofcpus(I have 4 on the machine) + basemax_searches
Therefore, in "C:-Program Files-Splunk-etc-system-local" I have manually added limits.conf with the following stanzas:
[search] max_searches_per_cpu = 2 base_max_searches = 6
btool confirms that Splunk sees these values, but my dashboard is still limited to the first 10 searches. Should the changes that I made to limits.conf be sufficient, or is there another directory where I need to place these changes to limits.conf?
The maximum number of searches is proportional of the number of cores on the system, so you could improve the hardware.
Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu on the stanza maxsearchesper_cpu. If that is true then would the manual specification trump the actual number of cpus on the machine?,Thank you, gyslainlatsa. I was thinking that limits.config allows us to manually specify number of searches per cpu. If that is true then would that trump the number of cpus on the machine?