I have some searches that are configured using a normal cron schedule. However, they have stopped running. When viewing them through the ui they show a scheduled time of "none" in the object listing, but if you resave the search the scheduled time will reappear for a few minutes then disappear again. This doesn't seem to be a system wide issue as other users still have active and working scheduled searches. I found a few references to issues with a particular user causing the failure, but I cloned some of the saved searches so that I became the owner and they still exhibited the unscheduling behavior... The only log I found that seems like it could be pertinent is WARN SavedSplunker - Savedsearch scheduling cannot be inherited from another user's search. Schedule ignored for savedsearch_id="nobody;test_app;test_search" That didn't appear for all of the searches in question (others lost their schedule without causing the log) so I'm not sure if it is a misdirect. Any insights on where to look further would be greatly appreciated. Splunk Version 6.3.11 Splunk Build d17c287b5612 ... View more