Reporting
Highlighted

Why is scheduled job taking so long?

Communicator

I have a scheduled saved search that just calls a dbxoutput. When I run it manually, it finishes in a few minutes. When I schedule it to run, however, it takes 6 hours.

What logs/places should I check to try to find out why this is happening?

0 Karma
Highlighted

Re: Why is scheduled job taking so long?

Champion

Check to see whether you've supplied a timerange in the scheduled search. This a common mistake -- missing timerange. Without a timerange Splunk attempts to run the search across "All Time".

0 Karma
Highlighted

Re: Why is scheduled job taking so long?

Builder

Hi @matstap

You can find info about scheduled searches in

index=internal sourcetype=scheduler savedsearchname=yoursearchname

look at things like scheduledtime,dispatch time, run time, status

Thanks

View solution in original post