Query to find skipped scheduled searches not working correctly



We have a set of scheduled searches which are used for creating summary indexes. To check the list of skipped searches we use the following query:

index=internal sourcetype=scheduler status=skipped | timechart span="5m" count by savedsearchname

This query seems to be working fine when Splunk is running. However, when we stop and start Splunk, the skipped searches in that interval does not show up in the chart. Please tell me if this is the expected behavior.



Tags (1)

Re: Query to find skipped scheduled searches not working correctly

Esteemed Legend

Those searches weren't "skipped", the service was down; "skipped" means that splunk did not enough available resources (e.g. CPU cores) to run all of the searches that were scheduled so it had to deliberately drop ("skip") some of them. Skipped typically means a scheduled search did not finish before its next scheduled run should start - then that next run is skipped to avoid loading up the queue infinitely. You can file an Enhancement Request ticket but it will surely not get traction.

View solution in original post

0 Karma