What happens to the search when it reaches the search jobs quota?

[yuwtennis]

Hi all!

I am using splunk ver5.0.5 on RHEL 5 and appreciate if you can answer to my question.

I have set up srchJobsQuota in authorize.conf and confirmed it had worked by the log.

[role_operation]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
rest_apps_management = disabled
rest_apps_view = disabled
rest_properties_get = disabled
rest_properties_set = disabled
rtSrchJobsQuota = 2
search = enabled
srchDiskQuota = 500
srchIndexesAllowed = _internal
srchIndexesDefault = main
srchJobsQuota = 2
srchMaxTime = 0

07-22-2014 13:24:35.970 +0900 WARN DispatchCommand - Search not executed: Your maximum number of concurrent searches has been reached. usage=2 quota=2 user=operation. SearchId=1406003074.82

My understanding is that the search that was not executed is discarded instead of going into the waiting queue
and wait till the earlier search is done.

Is my understanding correct?

Thanks,
Yu

[yannK]

The search will be queues for a few seconds, in case a current jobs finishes.
Then if no search concurrency ressource is available, the search job will be skipped, and the warning published in the messages, and in the logs.