Splunk Search

Setting a queue for dashboards when maximum of concurrent historical searches has been reached

N-W
Explorer

I have a dashboard with several different base searches that is transformative searches. However I get the error of maximum amount of concurrent historical searches. 

Unfortunately we can't upgrade the cpu count or change the role. I was thinking is there a way of making it so that there is a queue set for them so for example when the first 3 are finished the next 3 searches starts. Or set the order of when the searches start and finish?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have each search contain a token that is set by the previous search.  The token could be a result or it can be defined in a <done> element.

<search>
  <query>index=_internal </query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
  <done>
    <set token="start_search2"></set>
  </done>
</search>
<search>
  <query>index=foo $start_search2$</query>
  <done>
    <set token="start_search3"></set>
  </done>
</search>
...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...