Monitoring Splunk

In Metrics.log group=searchscheduler what is the meaning of the "eligible" metric?

New Member

In Splunk Enterprise when looking at the metrics.log with the searchscheduler group there is a metric for "eligible" but I can't find out what this indicates.


index=_internal source=*metrics.log group=searchscheduler


For context this is on Splunk Enterprise 8.0.2006 Cloud and we have 3 search heads in a cluster.

I was able to find this documentation but in the section where it talks about groups there is nothing mentioning the searchscheduler group

Here's an example event:


09-29-2020 19:06:28.281 +0000 INFO  Metrics - group=searchscheduler, eligible=9, delayed=0, dispatched=0, skipped=0, total_lag=0, max_lag=0, window_max_lag=0, window_total_lag=0, max_running=3, actions_triggered=0, completed=3, total_runtime=21.251, max_runtime=19.212



The reason I am interested in this value is that when looking at all of the other metrics in this group (delegated, delegated_scheduled, delegated_waiting, dispatched, eligible, skipped, delayed, completed, actions_triggered) there was a noticeable dip in only the "eligible" metric during some periods where our alerts were not triggering actions. The dip in this metric affected only 2 out of 3 search heads.

Labels (2)
0 Karma


Just guessing here, but I'd say "eligible" is the number of enabled scheduled searches on that search head.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...