Knowledge Management

How to change the ACCELERATE Data Model saved searches out of quotas?

Explorer

We installed splunkappaws with default setting. The next day ALL the savedsearches were on the Skipped Search report because they were running as "nobody" and needed updated search quotas.

We changed the install to have all the objects owned by "admin". modified the metadata files and all the objects show in the web gui as owned by "admin". All the reports run fine now except for the below ACCELERATE searches.

I have been unable to locate these objects to change the owner and unsure how to even do this.
I can see the datamodels but not the accelerate searches.
How and what do I change to get these to be owned by "admin" so they will not run out of quotas.

scheduler.log error
INFO SavedSplunker - savedsearchid="nobody;splunkappaws;ACCELERATEDMsplunkappawsCloudFrontAccessLogACCELERATE", searchtype="datamodelacceleration", user="nobody", app="splunkappaws", savedsearchname="ACCELERATEDMsplunkappawsCloudFrontAccessLogACCELERATE", priority=default, status=skipped, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrencycategory="historicalscheduled", concurrencycontext="cluster-wide", concurrencylimit=270, scheduledtime=1517805900, windowtime=0

skipped search - savedsearch_name
ACCELERATEDMsplunkappawsCloudFrontAccessLogACCELERATE
ACCELERATEDMsplunkappawsDetailedBillingACCELERATE_
ACCELERATEDMsplunkappawsInstanceHourACCELERATE_
ACCELERATEDMsplunkappawsS3AccessLogACCELERATE
ACCELERATE705E6442-8741-4922-A554-A7C0D8D9FD7Dsplunkappawsadmin308f04f30c2782b1ACCELERATE_
ACCELERATE705E6442-8741-4922-A554-A7C0D8D9FD7Dsplunkappawsadmin945d9afb3516cfdfACCELERATE_
ACCELERATE705E6442-8741-4922-A554-A7C0D8D9FD7Dsplunkappawsadmina96344b626325889ACCELERATE_

Thank-you

SplunkTrust
SplunkTrust

Hi @dsbruce,

You are running out of resources in your SH cluster so that SH cluster is throwing message The maximum number of concurrent historical scheduled searches on this cluster has been reached, in this case you need to add more search head into your SH cluster OR you can schedule some of your searches to run at different time(odd time) like running Every 15 minutes searches to 01,16,31,46 minutes so that scheduled searches load on your SH cluster will distribute and SH cluster will not run out of resources at certain interval.

0 Karma

Explorer

Thank-you for the input, but we know this is not our issue. The issue is how do we change these jobs from running as "nobody" when the app is owner=admin and they do not show up in searches or data models settings

0 Karma