Schedule Search

[vumanhtai]

Hi Splunk Team
When I enter a dasborad, the search will start running. So why is there a schedule search. What is the effect of schedule search when I disable it? How do I disable all schedule searches because I find the schedule search is using too much CPU and my indexer is overloaded?
Thanks All

[ivanreis · Accepted solution]

"A scheduled report is a report that runs on a scheduled interval, and which can trigger an action each time it runs. You can define up to four actions for a scheduled report:

Send a report summary by email
Write the report results to a CSV lookup file
Set up a webhook that sends a message to an external web resource, such as a chatroom
Log and index searchable events"
For further information: https://docs.splunk.com/Documentation/Splunk/7.3.2/Report/Schedulereports

Do not remove your reports from schedule because those schedule are responsible to provide the output results to the dashboards.

If you are having issues of overloading on splunk environment, you need to determine which is causing this overloading on the indexers using the management console. It is possible that your current environment is not capable to process all the amount of load for indexing data and even run the scheduled reports/dashboards.

If you have deployed the managed console, please check this link here to assist you to determine where to bottle neck can be

https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/DMCoverview

Other potential alternative to assist you to determine what is going on, you can open a support case at Splunk and report the problems you are having and Splunk will reply back with the potential actions to mitigate or fix the issues.

[vumanhtai]

Thank ivanreis