topic Re: Splunk Searches Skipped in Splunk Enterprise

Splunk Searches Skipped

rlsplunker — Tue, 09 Nov 2021 18:26:07 GMT

Splunk Searches Skipped on the Cluster master console error messages

The percentage of non high priority searches skipped (44%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=1608..... Total skipped Searches=720...

Re: Splunk Searches Skipped

isoutamo — Tue, 09 Nov 2021 18:47:35 GMT

You should check what those are from MC (Settings - Monitoring Console - Searches - Schedule searches). There you can see when, where and what those are.
r. Ismo

Re: Splunk Searches Skipped

Roy_9 — Tue, 09 Nov 2021 20:22:04 GMT

@isoutamo After identifying those searches, what is the process to remove the warning message, since we are seeing the similar kind of issue on our SH where our SH health is red.

Does a SH cluster restart help?

Re: Splunk Searches Skipped

isoutamo — Wed, 10 Nov 2021 08:55:54 GMT

After you have identified those, you also see what was the reason for that. Then just fix the reason one by one. That could be e.g. too many search at same time => reschedule, no permission to indexed/run => fix permission/change ownership etc.