I have several dashboards with 8 to 15 graphs/saved searches each and when I try to display them I get **"The maximum number of historical concurrent system-wide searches has been reached. current=6 maximum=6 SearchId=admin__admin__search..."** I understand why and I tried increasing **base_max_searches = 2** but my CPU maxes out at 100% and my PC freezes.
What I would like to do is to run maybe 6 concurrent searches and when these are do, run the next batch of 6.
Other solution I thought of could be to used cache data/searches but I wonder about the following points:
- How can I cache a saved search so it's not executed each time I open the dashboard?
- I stop my Splunk service whenever I'm done with looking at the dashboard. Some weeks later, I will need to look at them again and will start Splunk. Can the saved searches be preserved?
- My saved searches have a cron schedule in savedsearches.conf, similar to `cron_schedule = 30 20 1-31 * *` with different time of the day.
I barely need to refresh my data, so I don't mind having to use the data cached even if it's 1 month old...
Which parameter can allow me to implement one of these solutions? Or can you think of a better way?
I got this Splunk setup from someone else so I'm not exactly sure about the entire configuration.
I'm using Splunk Enterprise 6.3.0
↧