A ticket has come across my desk today where a customer is getting different results from different search heads for a report.
After looking at the report, I see that there are easily 15 windows that are all running real-time historical searches.
What is your recommendation on how to teach this team and others how to get current data from their reports w/out breaking the system?
The messages drop down on a given search head is constantly displaying this type of message:
The maximum number of historical concurrent system-wide searches has been reached. current=12 maximum=12
Now, we can increase the max search limitation on any given search head VM, but that can only scale so much before the resources of the VM are expended.
Thanks for any guidance.
↧