Timing and how Splunk handles Scheduled Searches

[rmorlen]

We are trying to optimize the performance of our Splunk environment.

How does Splunk handle the following:

A scheduled search is scheduled to run every minute. It takes 20 minutes for the scheduled search to complete. Do 19 other searches get queued? Does Splunk ignore any additional runs of the search until the current search completes? Does Splunk not reschedule the next search until the current one completes?

I figure the person should inspect the search and then schedule it based on how long it takes to run. We are addressing that.

Thanks,
Randy

[rmorlen]

Yeah. We looked and didn't change anything. Basically we are working on some queries that report on the scheduled searches and report how long they are taking to run. We can then (manually) compare those with the frequency of their schedule and then give feedback to the owner of the scheduled search.

Thanks.

[rmorlen]

Thanks. That does help. Basically need to tweak savedsearches.conf.

[rtadams89]

Or you may not. gkanapathy explained the default settings, which are generally what you want. Consider carefully what you are changing, as changing realtime_schedule could result in a massive bog-down.

[gkanapathy]

This is controlled by the setting realtime_schedule in savedsearches.conf, and can be set so that a particular search behaves the way you choose. If you create a search through the GUI, the non-summary searches are set with this enabled, which means that some instances of the search may be skipped if previous ones have not completed. If you create summary searches in the GUI, then this is disabled, which means that all scheduled executions will be queued up.

[joy76]

Hi, gkanapathy.
I am just wondering...
What do you mean by "you create summary searches in the GUI" and
"you create a search through the GUI" ?