Maximum number of historical searches reached

[sc0tt]

I continually receive the error that I have reached the maximum number of historical searches (current=16 maximum=16). When I check the job monitor I usually only see 2-4 running; 2 of which are real-time searches.

How can I determine which searches are running and causing this error?

[yannK · Accepted solution]

Install the SOS app and look at the search activity dashboards.
Then compare the had hoc and scheduled searches.

http://apps.splunk.com/app/748/

[sc0tt]

Thanks, this was very helpful.