Splunk Search

What happens to the search when it reaches the search jobs quota?


Hi all!

I am using splunk ver5.0.5 on RHEL 5 and appreciate if you can answer to my question.

I have set up srchJobsQuota in authorize.conf and confirmed it had worked by the log.

cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
rest_apps_management = disabled
rest_apps_view = disabled
rest_properties_get = disabled
rest_properties_set = disabled
rtSrchJobsQuota = 2
search = enabled
srchDiskQuota = 500
srchIndexesAllowed = _internal
srchIndexesDefault = main
srchJobsQuota = 2
srchMaxTime = 0

07-22-2014 13:24:35.970 +0900 WARN DispatchCommand - Search not executed: Your maximum number of concurrent searches has been reached. usage=2 quota=2 user=operation. SearchId=1406003074.82

My understanding is that the search that was not executed is discarded instead of going into the waiting queue
and wait till the earlier search is done.

Is my understanding correct?


Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The search will be queues for a few seconds, in case a current jobs finishes.
Then if no search concurrency ressource is available, the search job will be skipped, and the warning published in the messages, and in the logs.

Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...