Why was the maximum number of real time concurrent searches not increased?

[DonaldvdHoogenb]

Hi fellow splunkers,

I have multiple search heads on which I want to increase the maximum number of (historical and) real time concurrent searches.
I have checked splunk answers on how to do it, and changed the limits.conf in the .../etc/system/local folder of Splunk on every search head. I put the following code in the limits.conf file: base_max_searches = 24. Since the standard number of base_max_searches is 6, I thought an increase in the concurrency of 18 historical and/or real time searches would happen.

However, this was not the case, since I still had 14 concurrent searches. Then I thought, it would have to be a user limit or maybe a role limit, so I checked the concurrency with two different users (both admin priveleges) and assigned extra concurrent searches to a role, but both did not increase the maximum concurrency.

Does anyone have an idea what I did wrong or how I can increase the concurrency of both historical as well as real time searches?

[inventsekar]

can you run this for last 24hrs (or one or two hrs before you made that base_max_searches change ) and check how many active_hist_searches and active_realtime_searches are there..

  index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches

[DonaldvdHoogenb]

I do not know for sure how that will help me. The historical searches are very fluctuating over the entire time period (between 0 and 20) while when I had the real-time dashboard open the real time searches were between 10 to 15 before the change and also 10 to 15 after the change. So it looks like my adjustment of the limits.conf did nothing (even though I performed a restart of the search heads after adjusting it).