Splunk Search

Setting a queue for dashboards when maximum of concurrent historical searches has been reached

N-W
Explorer

I have a dashboard with several different base searches that is transformative searches. However I get the error of maximum amount of concurrent historical searches. 

Unfortunately we can't upgrade the cpu count or change the role. I was thinking is there a way of making it so that there is a queue set for them so for example when the first 3 are finished the next 3 searches starts. Or set the order of when the searches start and finish?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have each search contain a token that is set by the previous search.  The token could be a result or it can be defined in a <done> element.

<search>
  <query>index=_internal </query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
  <done>
    <set token="start_search2"></set>
  </done>
</search>
<search>
  <query>index=foo $start_search2$</query>
  <done>
    <set token="start_search3"></set>
  </done>
</search>
...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...