Deployment Architecture

Why do skipped scheduled searches deactivate?

twinspop
Influencer

My Search Head Cluster(SHC) was skipping scheduled searches overnight. I've resolved the issue, but most impacted scheduled searches now show no "next scheduled time" and aren't running. If I disable/enable, or simply click through the "edit schedule" dialog, the scheduled time is restored and it will run next time. But scanning through > 1000 searches and doing this manually is a PITA.

Why did it happen? Is there a better way to restore?

Splunk Linux x64, 6.6.3
10 member SHC
28 indexers

0 Karma
1 Solution

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

View solution in original post

0 Karma

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...