Deployment Architecture

Why do skipped scheduled searches deactivate?

twinspop
Influencer

My Search Head Cluster(SHC) was skipping scheduled searches overnight. I've resolved the issue, but most impacted scheduled searches now show no "next scheduled time" and aren't running. If I disable/enable, or simply click through the "edit schedule" dialog, the scheduled time is restored and it will run next time. But scanning through > 1000 searches and doing this manually is a PITA.

Why did it happen? Is there a better way to restore?

Splunk Linux x64, 6.6.3
10 member SHC
28 indexers

0 Karma
1 Solution

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

View solution in original post

0 Karma

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...