Installation

Why am I seeing a higher skipped/deferred in my search head cluster after upgrading to 9.x ?

rphillips_splk
Splunk Employee
Splunk Employee

I recently upgraded my search head cluster to 9.x and since then my skipped/deferred searches have sky rocketed.

 

 

index=_internal source=*scheduler.log  
status=* | timechart span=60s count by status

 

 

 

Labels (1)
Tags (2)
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Please see this knowledge article for details on the known issue and fix/workaround:
https://splunk.my.site.com/customer/s/article/High-Skipped-Search-Ratio-after-upgrading-to-9-x

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...