Reporting

Skipped Jobs - Accelerated Data Models

bill_king
Path Finder

Not sure where & how to address the below skipped job.  I would appreciate any guidance

 

Report Name Skip Reason (Skip Count) Alert Actions

_ACCELERATE_DM_SA-IdentityManagement_Identity_Management.Expired_Identity_Activity_ACCELERATE_The maximum number of concurrent historical scheduled searches on this instance has been reached (1)none
Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @bill_king,

This error does not mean there is a problem on this report. You get this error, because your search head compute resources (CPU core count) is not enough for running concurrent search jobs.

- You can check your scheduled saved searches, alert, correlation search schedule times? Generally most of the scheduled jobs run every beginning hour. Because 5 min, 10 min, 15 min, 30 min, 60min schedules triggers at 00 minute every hour. You can try to change schedule times/periods.

- It is best to use Schedule window "auto" on schedule settings. 

- If you CPU usage is not high you can tweak below settings on Search Head;

Server settings » Search preferences
Relative concurrency limit for scheduled searches --> 75
Relative concurrency limit for summarization searches --> 100

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @bill_king,

This error does not mean there is a problem on this report. You get this error, because your search head compute resources (CPU core count) is not enough for running concurrent search jobs.

- You can check your scheduled saved searches, alert, correlation search schedule times? Generally most of the scheduled jobs run every beginning hour. Because 5 min, 10 min, 15 min, 30 min, 60min schedules triggers at 00 minute every hour. You can try to change schedule times/periods.

- It is best to use Schedule window "auto" on schedule settings. 

- If you CPU usage is not high you can tweak below settings on Search Head;

Server settings » Search preferences
Relative concurrency limit for scheduled searches --> 75
Relative concurrency limit for summarization searches --> 100

If this reply helps you an upvote and "Accept as Solution" is appreciated.

richgalloway
SplunkTrust
SplunkTrust

The job name is in the format ACCELERATE_DM_<app name>_<datamodel name>_ACCELERATE.

---
If this reply helps you, Karma would be appreciated.
0 Karma

bill_king
Path Finder

your response does not make sense to me on where & how to fix the issue.  

 
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...