My Search Head Cluster(SHC) was skipping scheduled searches overnight. I've resolved the issue, but most impacted scheduled searches now show no "next scheduled time" and aren't running. If I disable/enable, or simply click through the "edit schedule" dialog, the scheduled time is restored and it will run next time. But scanning through > 1000 searches and doing this manually is a PITA.
Why did it happen? Is there a better way to restore?
Splunk Linux x64, 6.6.3
10 member SHC
28 indexers
Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.
Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.