Splunk Search

What happens to the search when it reaches the search jobs quota?


Hi all!

I am using splunk ver5.0.5 on RHEL 5 and appreciate if you can answer to my question.

I have set up srchJobsQuota in authorize.conf and confirmed it had worked by the log.

cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
appsmanagement = disabled
appsview = disabled
propertiesget = disabled
properties_set = disabled
rtSrchJobsQuota = 2
search = enabled
srchDiskQuota = 500
srchIndexesAllowed = _internal
srchIndexesDefault = main
srchJobsQuota = 2
srchMaxTime = 0

07-22-2014 13:24:35.970 +0900 WARN DispatchCommand - Search not executed: Your maximum number of concurrent searches has been reached. usage=2 quota=2 user=operation. SearchId=1406003074.82

My understanding is that the search that was not executed is discarded instead of going into the waiting queue
and wait till the earlier search is done.

Is my understanding correct?


Tags (3)
0 Karma

Splunk Employee
Splunk Employee

The search will be queues for a few seconds, in case a current jobs finishes.
Then if no search concurrency ressource is available, the search job will be skipped, and the warning published in the messages, and in the logs.