how do i remove the saved search warning when i switch to free?

[jrich523]

I get a message that says

Search scheduler is disabled in Splunk's Free version. Scheduled searches that populate the summary index were found, they will not be executed - this might impact load times for dashboards that depend on the summary index. More Info

i click on the more info but it doesnt tell me how to stop it from showing up.

[danlobelle · Accepted solution]

I think that if you go through the savedsearches.conf for the Windows app and change all of the enableSched = 1 lines to enableSched = 0, then you should be able to re-enable the app without triggering that error.

[muebel]

If you are responsible for maintaining your Splunk implementation's config, you can simply remove the saved searches in question.

Navigate to http://localhost:8000/en-US/manager/search/saved/searches

and click "Scheduled Time" to find which saved searches have a scheduled time. You can then find these searches in the various savedsearch.conf files, or perhaps disable them.

This should stop this warning from showing (I would suppose)

[jrich523]

I've disabled the windows app and that seems to have removed the banner. i assume the windows app is now worthless with the free version because i cant run schedules?

[jrich523]

I've done that, and all of the scheduled times are set to 'None'. in looking at the config files (multiple savedsearches.conf) i didnt see any times set except for the one related to the Windows app, but im not really sure what to do with it. for example: cron_schedule = 4 */2 * * *

[jrodman]

You could also disable just their schedule, if they had any other utility (probably not, for summary-oriented searches).