Hello community and experts,
Is it possible to set a max concurrent search for a particular saved search?
The use case is that:
Your feedback would be greatly appreciated!
Thanks in advance!
Thanks @Richfez for your advice!
Yes, we can create a particular Splunk user and a particular role for this purpose.
Is it possible to specify a concurrent search to a role? would you please be kind enough to point me to relevant splunk doc?
Thanks @soutamo for your further inputs!
So, if I want a particular API user to be able to run only 1 concurrent search, then I would create a custom role with srchJobsQuota=1 and assign this role to the API user - - - did I get it right?