Check if the
scheduled searches have any of these features:
SPL commands `sendemail` OR `outputlookup` (and possibly others like service now ones that start with `snow*`, depending on what apps you have installed and what custom commands they create and what those commands do) Alert actions of any kind. Referenced inside of other SPL (dahsboards, panels, reports, or saved searches) through `| loadjob` or `| savedsearch`.
usually scheduled searches aren't used in dashboards but only in alerts and to populate lookups or summaries or reports to use in dashboards.
To understand if you can modify frequency of your scheduled searches, you should at first point the the heaviest ones and see their own scope (alert, lookup, summary or report).
So you can choose if the frequency is correct or not:
This search will list the scheduled searches with the scheduled time, and status. From here you can see if the scheduled is getting used anywhere or not
index=_internal source=*scheduler.log | eval sched = strftime(scheduled_time, "%Y-%m-%d %H:%M:%S") | table sched status savedsearch_name
Then you can use below to list all the scheduled searches and then compare the results
| rest /services/saved/searches search="is_scheduled=1"