Installation

Why am I seeing a higher skipped/deferred in my search head cluster after upgrading to 9.x ?

rphillips_splk
Splunk Employee
Splunk Employee

I recently upgraded my search head cluster to 9.x and since then my skipped/deferred searches have sky rocketed.

 

 

index=_internal source=*scheduler.log  
status=* | timechart span=60s count by status

 

 

 

Labels (1)
Tags (2)
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Please see this knowledge article for details on the known issue and fix/workaround:
https://splunk.my.site.com/customer/s/article/High-Skipped-Search-Ratio-after-upgrading-to-9-x

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...