https://community.splunk.com/t5/Monitoring-Splunk/Skipped-Search/m-p/692076#M10253 <P>Hi Team,</P> <P>An alert is scheduled to run for every 2 hours&nbsp;<BR />It is getting skipped<BR />per day the alert will run - 12 times<BR />For a week 12*7 = 84 times a week<BR /><BR />We could see in the skipped search result that the alert is skipped for 3000 times in last 7 days<BR />How is it possible?<BR /><BR />Below search is used to find the skipped search</P> <LI-CODE lang="markup">splunk_server=*prod1-heavy index="_internal" sourcetype="scheduler" host=*-prod1-heavy | eval scheduled=strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | lookup search_env_mapping host AS host OUTPUT tenant | stats count values(scheduled) as scheduled values(savedsearch_name) as search_name values(status) as status values(reason) as reason values(run_time) as run_time values(dm_node) as dm_node values(sid) as sid by savedsearch_name tenant | sort -count | search status!=success | table scheduled, savedsearch_name, status, reason,count,tenant</LI-CODE> Mon, 01 Jul 2024 12:06:17 GMT VijaySrrie 2024-07-01T12:06:17Z https://community.splunk.com/t5/Monitoring-Splunk/Skipped-Search/m-p/692076#M10253 <P>Hi Team,</P> <P>An alert is scheduled to run for every 2 hours&nbsp;<BR />It is getting skipped<BR />per day the alert will run - 12 times<BR />For a week 12*7 = 84 times a week<BR /><BR />We could see in the skipped search result that the alert is skipped for 3000 times in last 7 days<BR />How is it possible?<BR /><BR />Below search is used to find the skipped search</P> <LI-CODE lang="markup">splunk_server=*prod1-heavy index="_internal" sourcetype="scheduler" host=*-prod1-heavy | eval scheduled=strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | lookup search_env_mapping host AS host OUTPUT tenant | stats count values(scheduled) as scheduled values(savedsearch_name) as search_name values(status) as status values(reason) as reason values(run_time) as run_time values(dm_node) as dm_node values(sid) as sid by savedsearch_name tenant | sort -count | search status!=success | table scheduled, savedsearch_name, status, reason,count,tenant</LI-CODE> Mon, 01 Jul 2024 12:06:17 GMT https://community.splunk.com/t5/Monitoring-Splunk/Skipped-Search/m-p/692076#M10253 VijaySrrie 2024-07-01T12:06:17Z https://community.splunk.com/t5/Monitoring-Splunk/Skipped-Search/m-p/692083#M10254 <P>Perhaps the alert is not configured as expected.&nbsp; Please share the savedsearches.conf stanza for the alert so we can check for errors.</P> Mon, 01 Jul 2024 12:04:10 GMT https://community.splunk.com/t5/Monitoring-Splunk/Skipped-Search/m-p/692083#M10254 richgalloway 2024-07-01T12:04:10Z