topic Re: Scheduled Saved Search Limit in Reporting

Scheduled Saved Search Limit

jjordaan — Fri, 08 Apr 2011 04:11:50 GMT

Is there a limit on the number of scheduled saved searches allowed? Running an enterprise edition. Logged in as a power user. I'm able to set the scheduling, but it deactivates shortly after I have saved. Also noticed that I cannot create more than five.

Re: Scheduled Saved Search Limit

LukeMurphey — Fri, 08 Apr 2011 04:47:23 GMT

What do you mean by it deactivates? Are you saying it stops running on the schedule?
Also, what is stopping you from creating more than 5 (an error message, button is disabled, etc.)?

Re: Scheduled Saved Search Limit

jjordaan — Fri, 08 Apr 2011 15:02:15 GMT

Hi. Thanks for speady reply.

I opened all nine saved searches on separate tabs in browser.
Then scheduled all of them again this morning.
Splunk even remembers the scheduling settings, so I just had to click save.
And they all running fine.
Difference is I logged in as the admin user today.
Could have been a power user restriction, I am not sure.

Thanks.

Re: Scheduled Saved Search Limit

gkanapathy — Sun, 10 Apr 2011 01:24:48 GMT

There is a global limit on the number of concurrently running searches set in limits.conf and based on the number of CPU cores you have, and there is a role-based quota on the number of running jobs a particular user can have, and includes scheduled jobs. This latter is much higher for an admin than for a power user.

Re: Scheduled Saved Search Limit

jjordaan — Mon, 11 Apr 2011 13:31:38 GMT

Well, thank you for the info, I am reading the documentation around limits.

I had 11 scheduled searches running, over the weekend.
Unfortunately, only 2 of them are running today.

Will spend some time reading documentation and let you know if I find anything.

Thanks again.

Re: Scheduled Saved Search Limit

jjordaan — Mon, 11 Apr 2011 14:12:47 GMT

I have somewhat given up.

I create a saved search.Then click schedule.
I choose a "Time range" of 2m@m "Start time" nothing entered in "Finish time".
And I set the "Cron schedule" to */2 * * * *.
My "Alert conditions" are "if the number of events" "is greater than" 0.
I tick "Include results in email".
And my "Trigger shell script" is a script that sends me an sms.
As soon as it runs, it switches scheduling off.
As in the manage search UI, I can see that the scheduled times now "None".
And if I click the saved search, the scheduling is no longer selected.

Any ideas?

Re: Scheduled Saved Search Limit

jjordaan — Tue, 08 Nov 2011 21:15:08 GMT

The error log had the answer. The new sysadmin had deleted the old sysadmin user. This killed all his saved searches. Which turned out to be nearly every search. I had to manually clone each search as myself. Tiring but it worked 😄