seems that the quota for searches includes postprocess searches, can someone confirm this? If, so can I get a link to the documentation that covers this? I didn't see anything specific about postprocess searches in the authorize.conf.
so given the following scenario, what is the actual count of searches?
1 main search 5 postprocess searches
is this 6 searches total or just 1?
if this is 6 searches and using the default of 3 concurrently running search jobs, the main search and the first 2 postprocess jobs will run. It seems the remaining searches don't queue up or run, they just fail. Is there a way to get the remaining searches to run after the first 3 searches complete?
splunk version 4.3.4
thanks
so here is a sample test view that demonstrates the 1main search and multiple postprocess logic
using a guest account that just has the 'user' role that has a limit of 2 concurrent searches results in a blue or red bar( depending on Splunk version) noting the quota has been reached
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>test</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="showActionsMenu">False</param>
</module>
<module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1">
<param name="search">index=foo | fields _time, oid,metric,count,str| fields *</param>
<param name="earliest">-4h</param>
<param name="latest">now</param>
<module name="GenericHeader" layoutPanel="panel_row1_col1">
<param name="label">panel1</param>
<module name="HiddenPostProcess">
<param name="search">| where oid=420 | where metric="status_code" | timechart span=1m avg(count) by str</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text"></param>
<param name="charting.axisTitleX.text"></param>
<param name="charting.axisTitleX.visibility">collapsed</param>
<param name="charting.chart">line</param>
<param name="charting.chart.nullValueMode">connect</param>
<param name="charting.legend.placement">top</param>
<param name="charting.chart.resultTruncationLimit">10000</param>
<module name="FlashChart">
<param name="maxResultCount">100000</param>
<param name="width">100%</param>
<param name="height">250px</param>
<module name="Gimp" />
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="GenericHeader" layoutPanel="panel_row1_col2">
<param name="label">panel2</param>
<module name="HiddenPostProcess">
<param name="search">| where oid=677 | where metric="status_code" | timechart span=1m avg(count) by str</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text"></param>
<param name="charting.axisTitleX.text"></param>
<param name="charting.axisTitleX.visibility">collapsed</param>
<param name="charting.chart">line</param>
<param name="charting.chart.nullValueMode">connect</param>
<param name="charting.legend.placement">top</param>
<param name="charting.chart.resultTruncationLimit">10000</param>
<module name="FlashChart">
<param name="maxResultCount">1000000</param>
<param name="width">100%</param>
<param name="height">250px</param>
<module name="Gimp" />
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="GenericHeader" layoutPanel="panel_row2_col1">
<param name="label">panel3</param>
<module name="HiddenPostProcess">
<param name="search">| where oid=706 | where metric="status_code" | timechart span=1m avg(count) by str</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text"></param>
<param name="charting.axisTitleX.text"></param>
<param name="charting.axisTitleX.visibility">collapsed</param>
<param name="charting.chart">line</param>
<param name="charting.chart.nullValueMode">connect</param>
<param name="charting.legend.placement">top</param>
<param name="charting.chart.resultTruncationLimit">10000</param>
<module name="FlashChart">
<param name="maxResultCount">1000000</param>
<param name="width">100%</param>
<param name="height">250px</param>
<module name="Gimp" />
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="GenericHeader" layoutPanel="panel_row2_col2">
<param name="label">panel4</param>
<module name="HiddenPostProcess">
<param name="search">| where oid=706 | where metric="status_code" | timechart span=1m avg(count) by str</param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text"></param>
<param name="charting.axisTitleX.text"></param>
<param name="charting.axisTitleX.visibility">collapsed</param>
<param name="charting.chart">line</param>
<param name="charting.chart.nullValueMode">connect</param>
<param name="charting.legend.placement">top</param>
<param name="charting.chart.resultTruncationLimit">10000</param>
<module name="FlashChart">
<param name="maxResultCount">1000000</param>
<param name="width">100%</param>
<param name="height">250px</param>
<module name="Gimp" />
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>