One of my servers is skipping a lot of accelerated searches, like 80% per each hour. I've got Splunk Enterprise Security (ES) on this server, as well as these additional accelerated searches, ~48 of them. These searches are the only ones being skipped, none of the ES searches are being skipped.
I was concerned that my accelerated searches weren't formed correctly, or if I didn't have enough hardware for the box (16 CPU/64GB). If that's the case, is there something on the server I can see that will show when all the cores might be in use and for how long?
My accelerated searches have a summary range of 1 year and w/ a time range between 24 days, 30 days, or 15 minutes and now, though none of the searches are scheduled. The searches do get run, and the accelerated reports show 99% complete or fully complete summary status. Any help you can provide would be appreciated.
