https://community.splunk.com/t5/Splunk-Dev/Saved-Search-not-returning-all-events/m-p/360956#M5873 <P>How often do you run this saved search?<BR /> If a saved search is scheduled to run every minute, but it takes five minutes to run, then it will skip the next four times that it tries to run....</P> Fri, 16 Mar 2018 14:46:19 GMT Azeemering 2018-03-16T14:46:19Z https://community.splunk.com/t5/Splunk-Dev/Saved-Search-not-returning-all-events/m-p/360955#M5872 <P>Hi All,</P> <P>We have a Splunk saved search in which we are querying same index but multiple sourcetypes like below:</P> <P>(Index=A sourcetype=A1) OR (index=A (sourcetype=A2 OR sourcetype=A3 OR sourcetype=A4))</P> <P>Issue is sometimes the events from 2nd part is not returned (Sourcetype A2, A3 and A4) but events from 1st part is correctly returned.</P> <P>Below are some messages from internal logs:</P> <P>search_type=" scheduled ", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1, scheduled_time=1521180300, window_time=0</P> <P>search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0</P> <P>search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0</P> Tue, 29 Sep 2020 18:33:18 GMT https://community.splunk.com/t5/Splunk-Dev/Saved-Search-not-returning-all-events/m-p/360955#M5872 varun85negi 2020-09-29T18:33:18Z https://community.splunk.com/t5/Splunk-Dev/Saved-Search-not-returning-all-events/m-p/360956#M5873 <P>How often do you run this saved search?<BR /> If a saved search is scheduled to run every minute, but it takes five minutes to run, then it will skip the next four times that it tries to run....</P> Fri, 16 Mar 2018 14:46:19 GMT https://community.splunk.com/t5/Splunk-Dev/Saved-Search-not-returning-all-events/m-p/360956#M5873 Azeemering 2018-03-16T14:46:19Z