It is noticed that detection rule is getting failed by showing the bellow error message.
"Consider increasing your look back time or adding more Kibana instances."
I have tried increasing the look back time from 1 minute to 5minute. But still there are multiple instances getting failed.
Kindly let me know why we need to consider about adding more kibana instances in this situation? According to my understanding querying more rules will be taking more resources in elasticsearch and not in kibana instance resource.