Splunk Search

"Your maximum number of concurrent searches has been reached" Why are scheduled reports not cached?

JohnWright8
Path Finder

Background: I created a dashboard (actually a few dashboards) that used many heavy hitting searches. Well, the Splunk servers couldn't handle the load so I redesigned to using scheduled reports. The users lost flexibility and I had to do a lot more work (instead of four dashboards with user flexibility for report time ranges, I'll have 200+ reports with fixed time ranges) to create all these reports and dashboards, but it seemed to be working.

Problem: Two days later I go to redesign one of the dashboards and the server is failing with:

In handler 'savedsearch': Search not executed: Your maximum number of concurrent searches has been reached. usage=10 quota=10 user=...

It seems like the server isn't caching and remembering that it has already run the report. How can I check on this? How can I get it to reliably work and not pound the server over and over again running these reports over and over again?

0 Karma

JohnWright8
Path Finder

Thanks for the idea but the "useHistory" option didn't do anything, it still seems to be running the report every time the dashboard is displayed.

0 Karma

alemarzu
Motivator

May I ask, in which app is your dashboard and where did you create all those savedsearches ?

Because saved searches are app specific.

0 Karma

JohnWright8
Path Finder

Yes, I have a dedicated app and all the reports were created in that app.

0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...