https://community.splunk.com/t5/Monitoring-Splunk/Alert-setup-best-practice-to-avoid-max-concurrent-searches/m-p/510058#M4345 <P>Hi, We are trying to set up around 60 alerts. Ideally, Each alert is set up to run every 3 minutes and check the data for the last 3 minutes. I am aware of the issue with concurrent searches and alerts getting skipped when there are more than 5 concurrent searches.&nbsp;</P><P>What is the best way to create these alerts?</P><P>Is there a way to set up the alerts to run between minutes like below example?&nbsp;</P><P>Example -&nbsp;</P><P>Alert 1 - 12:00:00</P><P>Alert 2 - 12:00:05</P><P>Alert 3 - 12:00:10</P><P>Alert 4 - 12:00:15</P> Mon, 20 Jul 2020 15:43:49 GMT pdantuuri0411 2020-07-20T15:43:49Z https://community.splunk.com/t5/Monitoring-Splunk/Alert-setup-best-practice-to-avoid-max-concurrent-searches/m-p/510058#M4345 <P>Hi, We are trying to set up around 60 alerts. Ideally, Each alert is set up to run every 3 minutes and check the data for the last 3 minutes. I am aware of the issue with concurrent searches and alerts getting skipped when there are more than 5 concurrent searches.&nbsp;</P><P>What is the best way to create these alerts?</P><P>Is there a way to set up the alerts to run between minutes like below example?&nbsp;</P><P>Example -&nbsp;</P><P>Alert 1 - 12:00:00</P><P>Alert 2 - 12:00:05</P><P>Alert 3 - 12:00:10</P><P>Alert 4 - 12:00:15</P> Mon, 20 Jul 2020 15:43:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/Alert-setup-best-practice-to-avoid-max-concurrent-searches/m-p/510058#M4345 pdantuuri0411 2020-07-20T15:43:49Z https://community.splunk.com/t5/Monitoring-Splunk/Alert-setup-best-practice-to-avoid-max-concurrent-searches/m-p/510061#M4346 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/138972">@pdantuuri0411</a>&nbsp;</P><P>Its possible to distribute the search jobs either by using one of the below techniques</P><UL><LI>schedule_priority (use this for better results)</LI><LI>search window</LI></UL><P>you have to configure it through searches, reports &amp; alerts -&gt; Edit -&gt; Advanced Edit&nbsp;</P><P>OR&nbsp;</P><P>add below attributes to the concerned stanza in savedsearches.conf</P><LI-CODE lang="markup">schedule_priority = [default | higher | highest] schedule_window = &lt;unsigned integer&gt; | auto</LI-CODE><P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/AlertSchedulingBestPractices" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.5/Alert/AlertSchedulingBestPractices</A></P><P>Hope this helps</P> Mon, 20 Jul 2020 16:03:18 GMT https://community.splunk.com/t5/Monitoring-Splunk/Alert-setup-best-practice-to-avoid-max-concurrent-searches/m-p/510061#M4346 anilchaithu 2020-07-20T16:03:18Z