Reporting

Why are my searches becoming unscheduled but still have a schedule configured?

Engager

I have some searches that are configured using a normal cron schedule. However, they have stopped running. When viewing them through the ui they show a scheduled time of "none" in the object listing, but if you resave the search the scheduled time will reappear for a few minutes then disappear again. This doesn't seem to be a system wide issue as other users still have active and working scheduled searches.

I found a few references to issues with a particular user causing the failure, but I cloned some of the saved searches so that I became the owner and they still exhibited the unscheduling behavior...

The only log I found that seems like it could be pertinent is
WARN SavedSplunker - Savedsearch scheduling cannot be inherited from another user's search. Schedule ignored for savedsearch_id="nobody;test_app;test_search"

That didn't appear for all of the searches in question (others lost their schedule without causing the log) so I'm not sure if it is a misdirect.

Any insights on where to look further would be greatly appreciated.

Splunk Version
6.3.11
Splunk Build
d17c287b5612

1 Solution

Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

View solution in original post

Engager

Turns out we had some random config land in our savedsearches.conf and meta for a particular app that was causing issues. Based on the config it looks like someone attempted to make a search via the API, but it landed with the names as "default" causing the scheduler to fail. Removing the stanza for the "default" search resolved the issue.

View solution in original post