Deployment Architecture

Why do skipped scheduled searches deactivate?

twinspop
Influencer

My Search Head Cluster(SHC) was skipping scheduled searches overnight. I've resolved the issue, but most impacted scheduled searches now show no "next scheduled time" and aren't running. If I disable/enable, or simply click through the "edit schedule" dialog, the scheduled time is restored and it will run next time. But scanning through > 1000 searches and doing this manually is a PITA.

Why did it happen? Is there a better way to restore?

Splunk Linux x64, 6.6.3
10 member SHC
28 indexers

0 Karma
1 Solution

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

View solution in original post

0 Karma

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...