https://community.splunk.com/t5/Splunk-Enterprise/Health-Monitor-Engine-Scheduler-Lags-and-Skipped/m-p/672583#M18177 <P>Hi there.<BR />I would like to know about Splunk Health engine, Enterprise 8.2.12, 3 SHC,</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verbal_666_1-1703216686894.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28649iE3EE1B240720C341/image-size/medium?v=v2&amp;px=400" role="button" title="verbal_666_1-1703216686894.png" alt="verbal_666_1-1703216686894.png" /></span></P><P>&nbsp;</P><OL><LI>HOW it considers a savedsearch a Lagged search? Based on same previous 24h search runs and doing an average running times? Since we have many many heavy searches that end up also in 10/15m</LI><LI>WHY, sometimes, i found in Skipped search monitor a 100% of skipped search (1 from 1, when we have hundreds of scheduled searches)? WHILE, searching the scheduler log, i found something like 70.000 success / 68 skipped (scheduled every minute or every two, concurrency is a factor i calculate and there's no problem) in last 24h ? WHY 100%? Is it a bug? I also search for a single scheduled search per day savedsearches, but all (few) are in "<EM>success</EM>" status <span class="lia-unicode-emoji" title=":face_with_rolling_eyes:">🙄</span></LI></OL><P>When those strange things occur, sometimes, restarting the cluster, make health monitor to reset without warnings!!! Other times, in reverse, restarting the cluster make a clean health monitor to start giving warnings from point 1 &amp; 2 <span class="lia-unicode-emoji" title=":face_with_rolling_eyes:">🙄</span> ... strange behaviour!!! <span class="lia-unicode-emoji" title=":unamused_face:">😒</span></P><P>Thanks.</P> Fri, 22 Dec 2023 03:58:46 GMT verbal_666 2023-12-22T03:58:46Z https://community.splunk.com/t5/Splunk-Enterprise/Health-Monitor-Engine-Scheduler-Lags-and-Skipped/m-p/672583#M18177 <P>Hi there.<BR />I would like to know about Splunk Health engine, Enterprise 8.2.12, 3 SHC,</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="verbal_666_1-1703216686894.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/28649iE3EE1B240720C341/image-size/medium?v=v2&amp;px=400" role="button" title="verbal_666_1-1703216686894.png" alt="verbal_666_1-1703216686894.png" /></span></P><P>&nbsp;</P><OL><LI>HOW it considers a savedsearch a Lagged search? Based on same previous 24h search runs and doing an average running times? Since we have many many heavy searches that end up also in 10/15m</LI><LI>WHY, sometimes, i found in Skipped search monitor a 100% of skipped search (1 from 1, when we have hundreds of scheduled searches)? WHILE, searching the scheduler log, i found something like 70.000 success / 68 skipped (scheduled every minute or every two, concurrency is a factor i calculate and there's no problem) in last 24h ? WHY 100%? Is it a bug? I also search for a single scheduled search per day savedsearches, but all (few) are in "<EM>success</EM>" status <span class="lia-unicode-emoji" title=":face_with_rolling_eyes:">🙄</span></LI></OL><P>When those strange things occur, sometimes, restarting the cluster, make health monitor to reset without warnings!!! Other times, in reverse, restarting the cluster make a clean health monitor to start giving warnings from point 1 &amp; 2 <span class="lia-unicode-emoji" title=":face_with_rolling_eyes:">🙄</span> ... strange behaviour!!! <span class="lia-unicode-emoji" title=":unamused_face:">😒</span></P><P>Thanks.</P> Fri, 22 Dec 2023 03:58:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/Health-Monitor-Engine-Scheduler-Lags-and-Skipped/m-p/672583#M18177 verbal_666 2023-12-22T03:58:46Z https://community.splunk.com/t5/Splunk-Enterprise/Health-Monitor-Engine-Scheduler-Lags-and-Skipped/m-p/673359#M18268 <P>Hi</P><P>this could explain that behaviour to you&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.1.2/DMC/Configurefeaturemonitoring" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.1.2/DMC/Configurefeaturemonitoring</A></P><P>Based on this instructions you could see what those health messages means.</P><P>r. Ismo</P> Fri, 05 Jan 2024 13:59:45 GMT https://community.splunk.com/t5/Splunk-Enterprise/Health-Monitor-Engine-Scheduler-Lags-and-Skipped/m-p/673359#M18268 isoutamo 2024-01-05T13:59:45Z