Reporting

Why are my searches becoming unscheduled but still have a schedule configured?

David_C
Engager

I have some searches that are configured using a normal cron schedule. However, they have stopped running. When viewing them through the ui they show a scheduled time of "none" in the object listing, but if you resave the search the scheduled time will reappear for a few minutes then disappear again. This doesn't seem to be a system wide issue as other users still have active and working scheduled searches.

I found a few references to issues with a particular user causing the failure, but I cloned some of the saved searches so that I became the owner and they still exhibited the unscheduling behavior...

The only log I found that seems like it could be pertinent is
WARN SavedSplunker - Savedsearch scheduling cannot be inherited from another user's search. Schedule ignored for savedsearch_id="nobody;test_app;test_search"

That didn't appear for all of the searches in question (others lost their schedule without causing the log) so I'm not sure if it is a misdirect.

Any insights on where to look further would be greatly appreciated.

Splunk Version
6.3.11
Splunk Build
d17c287b5612

1 Solution

David_C
Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

View solution in original post

David_C
Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...