I get a message that says
Search scheduler is disabled in Splunk's Free version. Scheduled searches that populate the summary index were found, they will not be executed - this might impact load times for dashboards that depend on the summary index. More Info
i click on the more info but it doesnt tell me how to stop it from showing up.
I think that if you go through the savedsearches.conf for the Windows app and change all of the enableSched = 1
lines to enableSched = 0
, then you should be able to re-enable the app without triggering that error.
I think that if you go through the savedsearches.conf for the Windows app and change all of the enableSched = 1
lines to enableSched = 0
, then you should be able to re-enable the app without triggering that error.
If you are responsible for maintaining your Splunk implementation's config, you can simply remove the saved searches in question.
Navigate to http://localhost:8000/en-US/manager/search/saved/searches
and click "Scheduled Time" to find which saved searches have a scheduled time. You can then find these searches in the various savedsearch.conf files, or perhaps disable them.
This should stop this warning from showing (I would suppose)
I've disabled the windows app and that seems to have removed the banner. i assume the windows app is now worthless with the free version because i cant run schedules?
I've done that, and all of the scheduled times are set to 'None'. in looking at the config files (multiple savedsearches.conf) i didnt see any times set except for the one related to the Windows app, but im not really sure what to do with it. for example: cron_schedule = 4 */2 * * *
You could also disable just their schedule, if they had any other utility (probably not, for summary-oriented searches).