I have configured 20 Alerts with below run every - "5 min" and Alert mode "Once Per Result". Each Alerts are generating more then 1000 events . As the Alert Action , a shell script is called.
So with this , Some of the alerts are executed properly and others are skipped. See below log from "scheduler.log".
Which limit in limits.conf do I need to change to allow the search to be queued?
We have alerts that we definitely do not want to be skipped, but sometimes they take longer to execute and the following search is skipped because the first is not finished yet.
The following is the current configuration in our environment. We are getting max_concurrent limit reached on one of the three Search Heads for specific Saved Search. It does not happen on rest of the two Search Heads. Search Head:- 3x16+10=58 Search Peer :- 1x20+6=26
Is it necessary to maintain identical parameters on both Search peers and Search heads?
Shall i increase max_searches_per_cpu on Search Peers from 1 to 2?