I see a number of events in my scheduler.log that have the string "status=continued" in them. Further, these entries lack the run_time (and other fields) that would seem to indicate successful saved search completion. What do these log events represent?
In my understanding, when a search is configured for continuous scheduling (realtime_schedule = 0) and no of concurrent searches exceeds the limit, Splunk will add an entry with status=continued as the search execution is queued up. It should log another entry with status=success or status=fail when search is executed after it's turn comes up.