Splunk Search

Setting a queue for dashboards when maximum of concurrent historical searches has been reached

N-W
Explorer

I have a dashboard with several different base searches that is transformative searches. However I get the error of maximum amount of concurrent historical searches. 

Unfortunately we can't upgrade the cpu count or change the role. I was thinking is there a way of making it so that there is a queue set for them so for example when the first 3 are finished the next 3 searches starts. Or set the order of when the searches start and finish?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have each search contain a token that is set by the previous search.  The token could be a result or it can be defined in a <done> element.

<search>
  <query>index=_internal </query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
  <done>
    <set token="start_search2"></set>
  </done>
</search>
<search>
  <query>index=foo $start_search2$</query>
  <done>
    <set token="start_search3"></set>
  </done>
</search>
...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...