Reporting

Why are my searches becoming unscheduled but still have a schedule configured?

David_C
Engager

I have some searches that are configured using a normal cron schedule. However, they have stopped running. When viewing them through the ui they show a scheduled time of "none" in the object listing, but if you resave the search the scheduled time will reappear for a few minutes then disappear again. This doesn't seem to be a system wide issue as other users still have active and working scheduled searches.

I found a few references to issues with a particular user causing the failure, but I cloned some of the saved searches so that I became the owner and they still exhibited the unscheduling behavior...

The only log I found that seems like it could be pertinent is
WARN SavedSplunker - Savedsearch scheduling cannot be inherited from another user's search. Schedule ignored for savedsearch_id="nobody;test_app;test_search"

That didn't appear for all of the searches in question (others lost their schedule without causing the log) so I'm not sure if it is a misdirect.

Any insights on where to look further would be greatly appreciated.

Splunk Version
6.3.11
Splunk Build
d17c287b5612

1 Solution

David_C
Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

View solution in original post

David_C
Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...