Reporting

Why is scheduled job taking so long?

matstap
Communicator

I have a scheduled saved search that just calls a dbxoutput. When I run it manually, it finishes in a few minutes. When I schedule it to run, however, it takes 6 hours.

What logs/places should I check to try to find out why this is happening?

0 Karma
1 Solution

PowerPacked
Builder

Hi @matstap

You can find info about scheduled searches in

index=_internal sourcetype=scheduler savedsearch_name=yoursearchname

look at things like scheduledtime,dispatch time, run time, status

Thanks

View solution in original post

PowerPacked
Builder

Hi @matstap

You can find info about scheduled searches in

index=_internal sourcetype=scheduler savedsearch_name=yoursearchname

look at things like scheduledtime,dispatch time, run time, status

Thanks

View solution in original post

the_wolverine
Champion

Check to see whether you've supplied a timerange in the scheduled search. This a common mistake -- missing timerange. Without a timerange Splunk attempts to run the search across "All Time".

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!