I have multiple search heads on which I want to increase the maximum number of (historical and) real time concurrent searches.
I have checked splunk answers on how to do it, and changed the limits.conf in the .../etc/system/local folder of Splunk on every search head. I put the following code in the limits.conf file: base_max_searches = 24. Since the standard number of basemaxsearches is 6, I thought an increase in the concurrency of 18 historical and/or real time searches would happen.
However, this was not the case, since I still had 14 concurrent searches. Then I thought, it would have to be a user limit or maybe a role limit, so I checked the concurrency with two different users (both admin priveleges) and assigned extra concurrent searches to a role, but both did not increase the maximum concurrency.
Does anyone have an idea what I did wrong or how I can increase the concurrency of both historical as well as real time searches?
I do not know for sure how that will help me. The historical searches are very fluctuating over the entire time period (between 0 and 20) while when I had the real-time dashboard open the real time searches were between 10 to 15 before the change and also 10 to 15 after the change. So it looks like my adjustment of the limits.conf did nothing (even though I performed a restart of the search heads after adjusting it).