Scheduled Saved Search Limit


Is there a limit on the number of scheduled saved searches allowed? Running an enterprise edition. Logged in as a power user. I'm able to set the scheduling, but it deactivates shortly after I have saved. Also noticed that I cannot create more than five.


The error log had the answer. The new sysadmin had deleted the old sysadmin user. This killed all his saved searches. Which turned out to be nearly every search. I had to manually clone each search as myself. Tiring but it worked 😄

Splunk Employee
Splunk Employee

There is a global limit on the number of concurrently running searches set in limits.conf and based on the number of CPU cores you have, and there is a role-based quota on the number of running jobs a particular user can have, and includes scheduled jobs. This latter is much higher for an admin than for a power user.

0 Karma


I have somewhat given up.

I create a saved search.Then click schedule.
I choose a "Time range" of 2m@m "Start time" nothing entered in "Finish time".
And I set the "Cron schedule" to */2 * * * *.
My "Alert conditions" are "if the number of events" "is greater than" 0.
I tick "Include results in email".
And my "Trigger shell script" is a script that sends me an sms.
As soon as it runs, it switches scheduling off.
As in the manage search UI, I can see that the scheduled times now "None".
And if I click the saved search, the scheduling is no longer selected.

Any ideas?

0 Karma


Well, thank you for the info, I am reading the documentation around limits.

I had 11 scheduled searches running, over the weekend.
Unfortunately, only 2 of them are running today.

Will spend some time reading documentation and let you know if I find anything.

Thanks again.

0 Karma


Hi. Thanks for speady reply.

I opened all nine saved searches on separate tabs in browser.
Then scheduled all of them again this morning.
Splunk even remembers the scheduling settings, so I just had to click save.
And they all running fine.
Difference is I logged in as the admin user today.
Could have been a power user restriction, I am not sure.


0 Karma


What do you mean by it deactivates? Are you saying it stops running on the schedule?
Also, what is stopping you from creating more than 5 (an error message, button is disabled, etc.)?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...