https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211520#M10109 <P>I have several reports scheduled to run at the same time with a window set to 5 minutes. <BR /> When the time they were scheduled to passes and I type the following command into the search window to check the status of these reports, it turns out almost none of them did run:</P> <P><EM>index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") |search sched="2016-09-23 10:15:00"| table sched status savedsearch_name</EM></P> <P>I also see <STRONG>sos_refresh_splunk_servers_cache</STRONG> under savedsearch_name a lot of times.<BR /> What is it, and how can I make these reports run as scheduled?<BR /> Thank you</P> Tue, 29 Sep 2020 11:08:26 GMT wsadowy1 2020-09-29T11:08:26Z https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211520#M10109 <P>I have several reports scheduled to run at the same time with a window set to 5 minutes. <BR /> When the time they were scheduled to passes and I type the following command into the search window to check the status of these reports, it turns out almost none of them did run:</P> <P><EM>index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") |search sched="2016-09-23 10:15:00"| table sched status savedsearch_name</EM></P> <P>I also see <STRONG>sos_refresh_splunk_servers_cache</STRONG> under savedsearch_name a lot of times.<BR /> What is it, and how can I make these reports run as scheduled?<BR /> Thank you</P> Tue, 29 Sep 2020 11:08:26 GMT https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211520#M10109 wsadowy1 2020-09-29T11:08:26Z https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211521#M10110 <P>on inputs.conf, what info you have for [search] stanza.</P> <P>can you run this for last 24hrs (or last 7 days) and check how many active_hist_searches and active_realtime_searches are there..</P> <PRE><CODE> index=_internal sourcetype=splunkd source=*metrics.log group=search_concurrency "system total" | table active_hist_searches active_realtime_searches </CODE></PRE> Tue, 29 Sep 2020 11:05:19 GMT https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211521#M10110 inventsekar 2020-09-29T11:05:19Z https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211522#M10111 <P>I'm using Web Splunk and I don't know how to open the inputs.conf file unfortunately.<BR /> As for the search you provieded. I ran it for the past 7 days and got over 190k rows of results. Would you like me to give you the sums of active_hists and active_realtime fields?</P> Tue, 29 Sep 2020 11:05:22 GMT https://community.splunk.com/t5/Reporting/Problem-with-scheduled-reports/m-p/211522#M10111 wsadowy1 2020-09-29T11:05:22Z