Archive
Highlighted

Why am I seeing several thousand skipped searches per day in the Splunk Deployment Monitor app?

New Member

Using Splunk 7.2.0.

While looking at the Monitoring Console and performing this search (see below) , I see almost 70,000 skipped searches a day coming from "splunkdeploymentmonitor" app...is this normal behavior?

index=_internal earliest=-24h status=skipped  sourcetype=scheduler 
| stats  count by host app | sort - count

I'm seeing a lot of this in the logs:

12-07-2018 17:11:31.387 -0600 INFO  SavedSplunker - savedsearch_id="nobody;splunk_deployment_monitor;_ACCELERATE_EC188A1D-7CB2-4CE3-A6B6-47B043EEB6EF_splunk_deployment_monitor_nobody_f9569426050d9eb4_ACCELERATE_", search_type="report_acceleration", user="nobody", app="splunk_deployment_monitor", savedsearch_name="_ACCELERATE_EC188A1D-7CB2-4CE3-A6B6-47B043EEB6EF_splunk_deployment_monitor_nobody_f9569426050d9eb4_ACCELERATE_", priority=default, status=skipped, reason="The maximum number of concurrent auto-summarization searches on this instance has been reached", concurrency_category="summarization_scheduled", concurrency_context="saved-search_instance-wide", concurrency_limit=3, scheduled_time=1544224200, window_time=0
0 Karma
Highlighted

Re: Why am I seeing several thousand skipped searches per day in the Splunk Deployment Monitor app?

Builder
0 Karma