I'm running Splunk Enterprise on my Windows machine and am facing an issue in loading my dashboard fully. The dashboard contains 2 tables and 14 scatter plots. When I load the dashboard, 6 of the 16 searches give an error. The error message for those 6 is this:
"In handler 'savedsearch': Search not executed: The maximum number of historical concurrent system-wide searches has been reached. current=10 maximum=10 SearchId=admin__admin__search__RMD5b21c14aa536784c7_at_1452546718_91"
limits.conf.spec defines max_hist_searches = max_searches_per_cpu x number_of_cpus(I have 4 on the machine) + base_max_searches
Therefore, in "C:-Program Files-Splunk-etc-system-local" I have manually added limits.conf with the following stanzas:
[search]
max_searches_per_cpu = 2
base_max_searches = 6
btool confirms that Splunk sees these values, but my dashboard is still limited to the first 10 searches. Should the changes that I made to limits.conf be sufficient, or is there another directory where I need to place these changes to limits.conf?
↧
