Deployment Architecture

Why do skipped scheduled searches deactivate?

twinspop
Influencer

My Search Head Cluster(SHC) was skipping scheduled searches overnight. I've resolved the issue, but most impacted scheduled searches now show no "next scheduled time" and aren't running. If I disable/enable, or simply click through the "edit schedule" dialog, the scheduled time is restored and it will run next time. But scanning through > 1000 searches and doing this manually is a PITA.

Why did it happen? Is there a better way to restore?

Splunk Linux x64, 6.6.3
10 member SHC
28 indexers

0 Karma
1 Solution

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

View solution in original post

0 Karma

twinspop
Influencer

Rolled through a restart of all SHC members. Initially, all "next scheduled times" were empty. After about 10 minutes, they all restored.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...