Reporting

how do i remove the saved search warning when i switch to free?

jrich523
Path Finder

I get a message that says

Search scheduler is disabled in Splunk's Free version. Scheduled searches that populate the summary index were found, they will not be executed - this might impact load times for dashboards that depend on the summary index. More Info

i click on the more info but it doesnt tell me how to stop it from showing up.

Tags (1)
1 Solution

danlobelle
Engager

I think that if you go through the savedsearches.conf for the Windows app and change all of the enableSched = 1 lines to enableSched = 0, then you should be able to re-enable the app without triggering that error.

View solution in original post

0 Karma

danlobelle
Engager

I think that if you go through the savedsearches.conf for the Windows app and change all of the enableSched = 1 lines to enableSched = 0, then you should be able to re-enable the app without triggering that error.

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

If you are responsible for maintaining your Splunk implementation's config, you can simply remove the saved searches in question.

Navigate to http://localhost:8000/en-US/manager/search/saved/searches

and click "Scheduled Time" to find which saved searches have a scheduled time. You can then find these searches in the various savedsearch.conf files, or perhaps disable them.

This should stop this warning from showing (I would suppose)

jrich523
Path Finder

I've disabled the windows app and that seems to have removed the banner. i assume the windows app is now worthless with the free version because i cant run schedules?

0 Karma

jrich523
Path Finder

I've done that, and all of the scheduled times are set to 'None'. in looking at the config files (multiple savedsearches.conf) i didnt see any times set except for the one related to the Windows app, but im not really sure what to do with it. for example: cron_schedule = 4 */2 * * *

0 Karma

jrodman
Splunk Employee
Splunk Employee

You could also disable just their schedule, if they had any other utility (probably not, for summary-oriented searches).

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!