Deployment Architecture

Skipped scheduler searches :Your maximum number of concurrent searches has been reached. usage=3104 quota=3000 user=admin.

ankithnageshshe
Path Finder

Hello All,

Lately I see a lot of skipped scheduler searches in my search head cluster (3) with the reason "Your maximum number of concurrent searches has been reached. usage=3104 quota=3000 user=admin".

If I view from DMC console, I see not more than 200 searches run for each search head summing up to almost 600~700 searches for admin user in the last 4 hours.

I do not see any active running searches neither in the search head job manager nor on the Scheduler activity in the DMC.
However I see a lot of deferred jobs for one of the search head in DMC console.

Do you think rolling restart of search heads will help here as I do not see any search related issue here.

Regards,
Ankith

Tags (1)
0 Karma
1 Solution

ankithnageshshe
Path Finder

Hi All,

Rolling restart of the SHC fixed the issue. Brought down the deferred jobs from 90K to 2K after the rolling restart.

But I'am trying to understand the difference between concurrency search quota for user( admin) and the historical system wide search quota. How this will impact my SHC performance?

Regards,
Ankith

View solution in original post

0 Karma

ankithnageshshe
Path Finder

Hi All,

Rolling restart of the SHC fixed the issue. Brought down the deferred jobs from 90K to 2K after the rolling restart.

But I'am trying to understand the difference between concurrency search quota for user( admin) and the historical system wide search quota. How this will impact my SHC performance?

Regards,
Ankith

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...