Splunk Search

Setting a queue for dashboards when maximum of concurrent historical searches has been reached

N-W
Explorer

I have a dashboard with several different base searches that is transformative searches. However I get the error of maximum amount of concurrent historical searches. 

Unfortunately we can't upgrade the cpu count or change the role. I was thinking is there a way of making it so that there is a queue set for them so for example when the first 3 are finished the next 3 searches starts. Or set the order of when the searches start and finish?

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have each search contain a token that is set by the previous search.  The token could be a result or it can be defined in a <done> element.

<search>
  <query>index=_internal </query>
  <earliest>-24h@h</earliest>
  <latest>now</latest>
  <done>
    <set token="start_search2"></set>
  </done>
</search>
<search>
  <query>index=foo $start_search2$</query>
  <done>
    <set token="start_search3"></set>
  </done>
</search>
...

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...