Hi,
I'm having random scheduled searches being missed (not skipped) and I don't know why.
Below is a sample of an every 5 min search. The 7:05 run was not running. I can't find anything in the logs that tell me why. Any suggestions on what to look for and where? This is just from _internal scheduler
scheduled_time dispatch_time endTime run_time status
2021-02-24 07:00:00 2021-02-24 07:00:37 2021-02-24 07:00:44 5.624 success
2021-02-24 07:00:00 2021-02-24 07:00:44 delegated_remote_completion
2021-02-24 07:00:00 2021-02-24 07:00:37 delegated_remote
2021-02-24 07:10:00 2021-02-24 07:11:31 2021-02-24 07:11:40 4.351 success
2021-02-24 07:10:00 2021-02-24 07:11:37 delegated_remote_completion
2021-02-24 07:10:00 2021-02-24 07:11:31 delegated_remote
Thank you!
Chris
This may help you to troubleshoot:
https://wiki.splunk.com/Community:TroubleshootingScheduledSearches