Why are my searches becoming unscheduled but still have a schedule configured?

[David_C]

I have some searches that are configured using a normal cron schedule. However, they have stopped running. When viewing them through the ui they show a scheduled time of "none" in the object listing, but if you resave the search the scheduled time will reappear for a few minutes then disappear again. This doesn't seem to be a system wide issue as other users still have active and working scheduled searches.

I found a few references to issues with a particular user causing the failure, but I cloned some of the saved searches so that I became the owner and they still exhibited the unscheduling behavior...

The only log I found that seems like it could be pertinent is
WARN SavedSplunker - Savedsearch scheduling cannot be inherited from another user's search. Schedule ignored for savedsearch_id="nobody;test_app;test_search"

That didn't appear for all of the searches in question (others lost their schedule without causing the log) so I'm not sure if it is a misdirect.

Any insights on where to look further would be greatly appreciated.

Splunk Version
6.3.11
Splunk Build
d17c287b5612

[David_C · Accepted solution]

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.