https://community.splunk.com/t5/Splunk-Search/large-delay-between-dispatch-time-and-scheduled-time-in-shc/m-p/417015#M120015 <P>Hi forum,</P> <P>we are facing large increasing delays between dispatch_time and scheduled_time in scheduler log. We see delays up to 200 seconds for searches which are scheduled every minute - resulting in not-scheduled searches.</P> <P>this directly correlates to "ERROR SHCRepJob - failed to delegate job job=SHPDelegateSearchJob peer="peername", guid="466C6F6D-2779-4BFD-AE1F-64A71D0A5AC8" saved_search=system;; err="<BR /> messages we see at the SHC Captain.</P> <P>Any hints? Other Single-Search-head instances do not show any issues. Using v.7.1.6</P> <P>Best Regards,</P> <P>Andreas</P> Wed, 30 Sep 2020 01:31:53 GMT schose 2020-09-30T01:31:53Z https://community.splunk.com/t5/Splunk-Search/large-delay-between-dispatch-time-and-scheduled-time-in-shc/m-p/417015#M120015 <P>Hi forum,</P> <P>we are facing large increasing delays between dispatch_time and scheduled_time in scheduler log. We see delays up to 200 seconds for searches which are scheduled every minute - resulting in not-scheduled searches.</P> <P>this directly correlates to "ERROR SHCRepJob - failed to delegate job job=SHPDelegateSearchJob peer="peername", guid="466C6F6D-2779-4BFD-AE1F-64A71D0A5AC8" saved_search=system;; err="<BR /> messages we see at the SHC Captain.</P> <P>Any hints? Other Single-Search-head instances do not show any issues. Using v.7.1.6</P> <P>Best Regards,</P> <P>Andreas</P> Wed, 30 Sep 2020 01:31:53 GMT https://community.splunk.com/t5/Splunk-Search/large-delay-between-dispatch-time-and-scheduled-time-in-shc/m-p/417015#M120015 schose 2020-09-30T01:31:53Z https://community.splunk.com/t5/Splunk-Search/large-delay-between-dispatch-time-and-scheduled-time-in-shc/m-p/417016#M120016 <P>Hi,</P> <P>Have you looked at <CODE>scheduler.log</CODE> on your Search Head Cluster Members ?</P> <P>Below query will help you to identify why captain failed to delegate job to SHC members.</P> <PRE><CODE>index=_internal host IN(SH1,SH2,SH3) sourcetype=scheduler status=delegated_remote_error </CODE></PRE> Tue, 30 Jul 2019 08:34:44 GMT https://community.splunk.com/t5/Splunk-Search/large-delay-between-dispatch-time-and-scheduled-time-in-shc/m-p/417016#M120016 harsmarvania57 2019-07-30T08:34:44Z